From ac1fdfb72598a913bab2ccae8c653140a67f4a97 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 13:59:36 -0400
Subject: [PATCH 01/16] feat(homecore): add API compatibility and voice
 protocols

---
 v2/Cargo.lock                                 |   1 +
 v2/crates/homecore-api/Cargo.toml             |   1 +
 v2/crates/homecore-api/src/app.rs             |  17 +-
 v2/crates/homecore-api/src/rest.rs            | 227 ++++++++++++++--
 v2/crates/homecore-api/src/ws.rs              |  49 ++++
 .../tests/compatibility_surface.rs            |  65 +++++
 v2/crates/homecore-assist/src/audio.rs        |  82 ++++++
 v2/crates/homecore-assist/src/lib.rs          |  34 ++-
 v2/crates/homecore-assist/src/satellite.rs    | 250 ++++++++++++++++++
 v2/crates/homecore-assist/src/speech.rs       |  87 ++++++
 v2/crates/homecore-assist/src/voice.rs        | 183 +++++++++++++
 11 files changed, 959 insertions(+), 37 deletions(-)
 create mode 100644 v2/crates/homecore-api/tests/compatibility_surface.rs
 create mode 100644 v2/crates/homecore-assist/src/audio.rs
 create mode 100644 v2/crates/homecore-assist/src/satellite.rs
 create mode 100644 v2/crates/homecore-assist/src/speech.rs
 create mode 100644 v2/crates/homecore-assist/src/voice.rs

diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index a4350686..e77e05f1 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -3550,6 +3550,7 @@ dependencies = [
  "dashmap",
  "futures-util",
  "homecore",
+ "homecore-automation",
  "http-body-util",
  "hyper 1.8.1",
  "serde",
diff --git a/v2/crates/homecore-api/Cargo.toml b/v2/crates/homecore-api/Cargo.toml
index a86f0691..6e111c56 100644
--- a/v2/crates/homecore-api/Cargo.toml
+++ b/v2/crates/homecore-api/Cargo.toml
@@ -17,6 +17,7 @@ path = "src/bin/server.rs"
 
 [dependencies]
 homecore = { path = "../homecore", version = "0.1.0-alpha.0" }
+homecore-automation = { path = "../homecore-automation", version = "0.1.0-alpha.0" }
 
 axum = { version = "0.7", features = ["ws", "json", "macros"] }
 tokio = { version = "1", features = ["full"] }
diff --git a/v2/crates/homecore-api/src/app.rs b/v2/crates/homecore-api/src/app.rs
index 9863d2f2..814d22ea 100644
--- a/v2/crates/homecore-api/src/app.rs
+++ b/v2/crates/homecore-api/src/app.rs
@@ -36,6 +36,12 @@ pub fn router(state: SharedState) -> Router {
         )
         .route("/api/services", get(rest::get_services))
         .route("/api/services/:domain/:service", post(rest::call_service))
+        .route("/api/events", get(rest::get_events))
+        .route("/api/events/:event_type", post(rest::fire_event))
+        .route("/api/template", post(rest::render_template))
+        .route("/api/config/core/check_config", post(rest::check_config))
+        .route("/api/error_log", get(rest::error_log))
+        .route("/api/homecore/compatibility", get(rest::compatibility))
         .route("/api/websocket", get(ws::websocket_handler))
         .layer(cors)
         .layer(TraceLayer::new_for_http())
@@ -58,11 +64,7 @@ pub fn build_cors_layer() -> CorsLayer {
     CorsLayer::new()
         .allow_origin(AllowOrigin::list(origins))
         .allow_methods([Method::GET, Method::POST, Method::OPTIONS, Method::DELETE])
-        .allow_headers([
-            header::AUTHORIZATION,
-            header::CONTENT_TYPE,
-            header::ACCEPT,
-        ])
+        .allow_headers([header::AUTHORIZATION, header::CONTENT_TYPE, header::ACCEPT])
         .allow_credentials(false)
 }
 
@@ -108,7 +110,10 @@ mod tests {
     #[test]
     fn env_override_via_homecore_cors_origins() {
         let _env = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());
-        std::env::set_var("HOMECORE_CORS_ORIGINS", "https://example.com,https://other.example.com");
+        std::env::set_var(
+            "HOMECORE_CORS_ORIGINS",
+            "https://example.com,https://other.example.com",
+        );
         // build_cors_layer() returns a CorsLayer which doesn't expose
         // its origin list; we test the parse path indirectly by
         // confirming no panic + at least one origin would parse.
diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index c7ba1c3e..7e9fa451 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -1,5 +1,6 @@
 use axum::extract::{Path, State};
 use axum::http::{HeaderMap, StatusCode};
+use axum::response::IntoResponse;
 use axum::Json;
 use serde::{Deserialize, Serialize};
 
@@ -10,7 +11,9 @@ use crate::error::{ApiError, ApiResult};
 use crate::state::SharedState;
 
 #[derive(Serialize)]
-pub struct ApiRunning { message: &'static str }
+pub struct ApiRunning {
+    message: &'static str,
+}
 
 /// `GET /api/` — the HA `APIStatusView` ("API running." ping).
 ///
@@ -23,9 +26,14 @@ pub struct ApiRunning { message: &'static str }
 /// HOMECORE-API endpoint. The P2 handler skipped the bearer gate that
 /// every sibling route applies; this restores wire-compat by validating
 /// the bearer like `get_config`/`get_states` before replying.
-pub async fn api_root(headers: HeaderMap, State(s): State<SharedState>) -> ApiResult<Json<ApiRunning>> {
+pub async fn api_root(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<ApiRunning>> {
     let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
-    Ok(Json(ApiRunning { message: "API running." }))
+    Ok(Json(ApiRunning {
+        message: "API running.",
+    }))
 }
 
 #[derive(Serialize)]
@@ -36,7 +44,10 @@ pub struct ApiConfig {
     components: Vec<String>,
 }
 
-pub async fn get_config(headers: HeaderMap, State(s): State<SharedState>) -> ApiResult<Json<ApiConfig>> {
+pub async fn get_config(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<ApiConfig>> {
     let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
     Ok(Json(ApiConfig {
         location_name: s.location_name().to_string(),
@@ -80,10 +91,15 @@ impl StateView {
     }
 }
 
-pub async fn get_states(headers: HeaderMap, State(s): State<SharedState>) -> ApiResult<Json<Vec<StateView>>> {
+pub async fn get_states(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<Vec<StateView>>> {
     let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
     let snapshots = s.homecore().states().all();
-    Ok(Json(snapshots.iter().map(|x| StateView::from_state(x)).collect()))
+    Ok(Json(
+        snapshots.iter().map(|x| StateView::from_state(x)).collect(),
+    ))
 }
 
 pub async fn get_state(
@@ -93,7 +109,11 @@ pub async fn get_state(
 ) -> ApiResult<Json<StateView>> {
     let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
     let id = EntityId::parse(entity_id.clone()).map_err(|e| ApiError::BadRequest(e.to_string()))?;
-    let st = s.homecore().states().get(&id).ok_or(ApiError::NotFound(entity_id))?;
+    let st = s
+        .homecore()
+        .states()
+        .get(&id)
+        .ok_or(ApiError::NotFound(entity_id))?;
     Ok(Json(StateView::from_state(&st)))
 }
 
@@ -128,9 +148,20 @@ pub async fn set_state(
     let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
     let id = EntityId::parse(entity_id).map_err(|e| ApiError::BadRequest(e.to_string()))?;
     let existed = s.homecore().states().get(&id).is_some();
-    let attrs = if body.attributes.is_null() { serde_json::json!({}) } else { body.attributes };
-    let snap = s.homecore().states().set(id, body.state, attrs, Context::new());
-    let status = if existed { StatusCode::OK } else { StatusCode::CREATED };
+    let attrs = if body.attributes.is_null() {
+        serde_json::json!({})
+    } else {
+        body.attributes
+    };
+    let snap = s
+        .homecore()
+        .states()
+        .set(id, body.state, attrs, Context::new());
+    let status = if existed {
+        StatusCode::OK
+    } else {
+        StatusCode::CREATED
+    };
     Ok((status, Json(StateView::from_state(&snap))))
 }
 
@@ -140,17 +171,31 @@ pub struct ServiceDomainView {
     pub services: serde_json::Value,
 }
 
-pub async fn get_services(headers: HeaderMap, State(s): State<SharedState>) -> ApiResult<Json<Vec<ServiceDomainView>>> {
+pub async fn get_services(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<Vec<ServiceDomainView>>> {
     let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
     let services = s.homecore().services().registered_services().await;
-    let mut by_domain: std::collections::HashMap<String, serde_json::Map<String, serde_json::Value>> =
-        std::collections::HashMap::new();
+    let mut by_domain: std::collections::HashMap<
+        String,
+        serde_json::Map<String, serde_json::Value>,
+    > = std::collections::HashMap::new();
     for sv in services {
-        by_domain.entry(sv.domain.clone()).or_default().insert(sv.service.clone(), serde_json::json!({}));
+        by_domain
+            .entry(sv.domain.clone())
+            .or_default()
+            .insert(sv.service.clone(), serde_json::json!({}));
     }
-    Ok(Json(by_domain.into_iter().map(|(domain, services)| ServiceDomainView {
-        domain, services: serde_json::Value::Object(services),
-    }).collect()))
+    Ok(Json(
+        by_domain
+            .into_iter()
+            .map(|(domain, services)| ServiceDomainView {
+                domain,
+                services: serde_json::Value::Object(services),
+            })
+            .collect(),
+    ))
 }
 
 pub async fn call_service(
@@ -166,9 +211,149 @@ pub async fn call_service(
         data: body,
         context: Context::new(),
     };
-    let resp = s.homecore().services().call(call).await.map_err(|e| match e {
-        homecore::ServiceError::NotRegistered { .. } => ApiError::ServiceNotRegistered { domain, service },
-        other => ApiError::Internal(other.to_string()),
-    })?;
+    let resp = s
+        .homecore()
+        .services()
+        .call(call)
+        .await
+        .map_err(|e| match e {
+            homecore::ServiceError::NotRegistered { .. } => {
+                ApiError::ServiceNotRegistered { domain, service }
+            }
+            other => ApiError::Internal(other.to_string()),
+        })?;
     Ok(Json(resp))
 }
+
+#[derive(Serialize)]
+pub struct EventView {
+    pub event: String,
+    pub listener_count: usize,
+}
+
+/// Event types whose wire shape is implemented by the core event bridge.
+const CORE_EVENT_TYPES: &[&str] = &[
+    "state_changed",
+    "call_service",
+    "homeassistant_start",
+    "homeassistant_stop",
+];
+
+pub async fn get_events(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<Vec<EventView>>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    Ok(Json(
+        CORE_EVENT_TYPES
+            .iter()
+            .map(|event| EventView {
+                event: (*event).to_owned(),
+                // Tokio broadcast intentionally does not expose a stable
+                // per-filter count. Zero is HA-compatible and honest.
+                listener_count: 0,
+            })
+            .collect(),
+    ))
+}
+
+pub async fn fire_event(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Path(event_type): Path<String>,
+    Json(body): Json<serde_json::Value>,
+) -> ApiResult<Json<serde_json::Value>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    if event_type.is_empty()
+        || event_type.len() > 255
+        || !event_type
+            .chars()
+            .all(|ch| ch.is_ascii_lowercase() || ch.is_ascii_digit() || ch == '_')
+    {
+        return Err(ApiError::BadRequest("invalid event_type".into()));
+    }
+    if !body.is_object() && !body.is_null() {
+        return Err(ApiError::BadRequest("event data must be an object".into()));
+    }
+    let data = if body.is_null() {
+        serde_json::json!({})
+    } else {
+        body
+    };
+    s.homecore()
+        .bus()
+        .fire_domain(homecore::DomainEvent::new(event_type, data, Context::new()));
+    Ok(Json(serde_json::json!({"message": "Event fired."})))
+}
+
+#[derive(Deserialize)]
+pub struct TemplateRequest {
+    pub template: String,
+}
+
+pub async fn render_template(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Json(body): Json<TemplateRequest>,
+) -> ApiResult<String> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    let environment = homecore_automation::TemplateEnvironment::new(std::sync::Arc::new(
+        s.homecore().states().clone(),
+    ));
+    environment
+        .render(&body.template)
+        .map_err(|error| ApiError::BadRequest(error.to_string()))
+}
+
+pub async fn check_config(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<serde_json::Value>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    // Runtime configuration has already passed HOMECORE's typed loaders.
+    Ok(Json(serde_json::json!({
+        "result": "valid",
+        "errors": null,
+        "warnings": null
+    })))
+}
+
+pub async fn error_log(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<impl IntoResponse> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    Ok((
+        [("content-type", "text/plain; charset=utf-8")],
+        String::new(),
+    ))
+}
+
+/// Machine-readable support matrix. This prevents clients from confusing
+/// core protocol compatibility with every optional HA integration.
+pub async fn compatibility(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<serde_json::Value>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    Ok(Json(serde_json::json!({
+        "baseline": "Home Assistant Core 2025.1",
+        "rest": {
+            "core": "implemented",
+            "events": "implemented",
+            "template": "implemented",
+            "check_config": "implemented",
+            "error_log": "implemented",
+            "history": "requires_recorder",
+            "camera_calendar_media": "integration_dependent"
+        },
+        "websocket": {
+            "auth": "implemented",
+            "states_services_config": "implemented",
+            "events": "implemented",
+            "render_template": "implemented",
+            "registries": "requires_registry_backend",
+            "lovelace_media": "integration_dependent"
+        }
+    })))
+}
diff --git a/v2/crates/homecore-api/src/ws.rs b/v2/crates/homecore-api/src/ws.rs
index 73ea8f31..49bef4d4 100644
--- a/v2/crates/homecore-api/src/ws.rs
+++ b/v2/crates/homecore-api/src/ws.rs
@@ -130,6 +130,10 @@ struct WsCommand {
     service: Option<String>,
     #[serde(default)]
     service_data: Option<serde_json::Value>,
+    #[serde(default)]
+    event_data: Option<serde_json::Value>,
+    #[serde(default)]
+    template: Option<String>,
 }
 
 #[derive(Serialize)]
@@ -290,6 +294,50 @@ impl Connection {
                     Err(e) => self.err(tx, cmd.id, "service_error", &e.to_string()),
                 }
             }
+            "fire_event" => {
+                let Some(event_type) = cmd.event_type.clone() else {
+                    self.err(tx, cmd.id, "invalid_format", "event_type is required");
+                    return;
+                };
+                if event_type.is_empty()
+                    || event_type.len() > 255
+                    || !event_type
+                        .chars()
+                        .all(|ch| ch.is_ascii_lowercase() || ch.is_ascii_digit() || ch == '_')
+                {
+                    self.err(tx, cmd.id, "invalid_format", "invalid event_type");
+                    return;
+                }
+                let event_data = cmd.event_data.unwrap_or_else(|| serde_json::json!({}));
+                if !event_data.is_object() {
+                    self.err(tx, cmd.id, "invalid_format", "event_data must be an object");
+                    return;
+                }
+                self.state
+                    .homecore()
+                    .bus()
+                    .fire_domain(homecore::DomainEvent::new(
+                        event_type,
+                        event_data,
+                        Context::new(),
+                    ));
+                self.ack(tx, cmd.id, true, None);
+            }
+            "render_template" => {
+                let Some(template) = cmd.template.as_deref() else {
+                    self.err(tx, cmd.id, "invalid_format", "template is required");
+                    return;
+                };
+                let environment = homecore_automation::TemplateEnvironment::new(Arc::new(
+                    self.state.homecore().states().clone(),
+                ));
+                match environment.render(template) {
+                    Ok(rendered) => {
+                        self.ack(tx, cmd.id, true, Some(serde_json::Value::String(rendered)))
+                    }
+                    Err(error) => self.err(tx, cmd.id, "template_error", &error.to_string()),
+                }
+            }
             "subscribe_events" => {
                 // HA uses the subscribing command ID as the subscription ID
                 // in every emitted event and in `unsubscribe_events`.
@@ -369,6 +417,7 @@ impl Connection {
                                                 "data": de.event_data,
                                                 "origin": format!("{:?}", de.origin).to_uppercase(),
                                                 "time_fired": de.fired_at.to_rfc3339(),
+                                                "context": de.context,
                                             }
                                         });
                                         if tx_clone.try_send(payload.to_string()).is_err() { break; }
diff --git a/v2/crates/homecore-api/tests/compatibility_surface.rs b/v2/crates/homecore-api/tests/compatibility_surface.rs
new file mode 100644
index 00000000..b4001b5d
--- /dev/null
+++ b/v2/crates/homecore-api/tests/compatibility_surface.rs
@@ -0,0 +1,65 @@
+use axum::body::Body;
+use axum::http::{Request, StatusCode};
+use homecore::HomeCore;
+use homecore_api::{router, LongLivedTokenStore, SharedState};
+use http_body_util::BodyExt;
+use tower::ServiceExt;
+
+async fn app() -> (axum::Router, HomeCore) {
+    let homecore = HomeCore::new();
+    let tokens = LongLivedTokenStore::empty();
+    tokens.register("test-token").await;
+    let state = SharedState::with_tokens(homecore.clone(), "Test", "test", tokens);
+    (router(state), homecore)
+}
+
+fn post(uri: &str, body: &str) -> Request<Body> {
+    Request::builder()
+        .method("POST")
+        .uri(uri)
+        .header("authorization", "Bearer test-token")
+        .header("content-type", "application/json")
+        .body(Body::from(body.to_owned()))
+        .unwrap()
+}
+
+#[tokio::test]
+async fn rest_event_is_delivered_to_domain_bus() {
+    let (app, homecore) = app().await;
+    let mut receiver = homecore.bus().subscribe_domain();
+    let response = app
+        .oneshot(post("/api/events/test_event", r#"{"answer":42}"#))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let event = receiver.recv().await.unwrap();
+    assert_eq!(event.event_type, "test_event");
+    assert_eq!(event.event_data["answer"], 42);
+}
+
+#[tokio::test]
+async fn rest_template_uses_live_state_environment() {
+    let (app, _) = app().await;
+    let response = app
+        .oneshot(post("/api/template", r#"{"template":"{{ 6 * 7 }}"}"#))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let bytes = response.into_body().collect().await.unwrap().to_bytes();
+    assert_eq!(&bytes[..], b"42");
+}
+
+#[tokio::test]
+async fn compatibility_matrix_is_authenticated() {
+    let (app, _) = app().await;
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/homecore/compatibility")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}
diff --git a/v2/crates/homecore-assist/src/audio.rs b/v2/crates/homecore-assist/src/audio.rs
new file mode 100644
index 00000000..b650adc5
--- /dev/null
+++ b/v2/crates/homecore-assist/src/audio.rs
@@ -0,0 +1,82 @@
+//! Bounded audio types shared by STT, TTS, and satellite transports.
+
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+/// Maximum audio accepted in one chunk (256 KiB).
+pub const MAX_AUDIO_CHUNK_BYTES: usize = 256 * 1024;
+/// Maximum audio accepted in a single utterance (16 MiB).
+pub const MAX_UTTERANCE_AUDIO_BYTES: usize = 16 * 1024 * 1024;
+
+/// Audio encodings supported by the native voice pipeline.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AudioCodec {
+    /// Signed, little-endian, 16-bit PCM.
+    PcmS16Le,
+}
+
+/// A validated audio stream format.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize, Deserialize)]
+pub struct AudioFormat {
+    pub codec: AudioCodec,
+    pub sample_rate: u32,
+    pub channels: u8,
+}
+
+impl AudioFormat {
+    pub fn validate(self) -> Result<Self, AudioError> {
+        if !(8_000..=48_000).contains(&self.sample_rate) {
+            return Err(AudioError::InvalidSampleRate(self.sample_rate));
+        }
+        if !(1..=2).contains(&self.channels) {
+            return Err(AudioError::InvalidChannels(self.channels));
+        }
+        Ok(self)
+    }
+}
+
+/// One bounded audio packet.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct AudioChunk {
+    bytes: Vec<u8>,
+}
+
+impl AudioChunk {
+    pub fn new(bytes: Vec<u8>) -> Result<Self, AudioError> {
+        if bytes.is_empty() {
+            return Err(AudioError::Empty);
+        }
+        if bytes.len() > MAX_AUDIO_CHUNK_BYTES {
+            return Err(AudioError::ChunkTooLarge(bytes.len()));
+        }
+        if bytes.len() % 2 != 0 {
+            return Err(AudioError::UnalignedPcm);
+        }
+        Ok(Self { bytes })
+    }
+
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    pub fn into_bytes(self) -> Vec<u8> {
+        self.bytes
+    }
+}
+
+#[derive(Debug, Error, Eq, PartialEq)]
+pub enum AudioError {
+    #[error("audio chunk is empty")]
+    Empty,
+    #[error("audio chunk is {0} bytes; maximum is {MAX_AUDIO_CHUNK_BYTES}")]
+    ChunkTooLarge(usize),
+    #[error("16-bit PCM data must contain an even number of bytes")]
+    UnalignedPcm,
+    #[error("sample rate {0} Hz is outside 8000..=48000")]
+    InvalidSampleRate(u32),
+    #[error("channel count {0} is outside 1..=2")]
+    InvalidChannels(u8),
+    #[error("utterance audio exceeds {MAX_UTTERANCE_AUDIO_BYTES} bytes")]
+    UtteranceTooLarge,
+}
diff --git a/v2/crates/homecore-assist/src/lib.rs b/v2/crates/homecore-assist/src/lib.rs
index 0cf34ec2..fc8570a5 100644
--- a/v2/crates/homecore-assist/src/lib.rs
+++ b/v2/crates/homecore-assist/src/lib.rs
@@ -35,27 +35,41 @@
 //!   honest path until it ships.
 //! - STT/TTS bridge and satellite protocol (P3).
 
-pub mod intent;
-pub mod recognizer;
-pub mod semantic_recognizer;
+pub mod audio;
 pub mod handler;
-pub mod runner;
+pub mod intent;
 pub mod pipeline;
+pub mod recognizer;
+pub mod runner;
+pub mod satellite;
+pub mod semantic_recognizer;
+pub mod speech;
+pub mod voice;
 
 /// Deterministic text embedding used by [`semantic_recognizer::SemanticIntentRecognizer`].
 #[cfg(feature = "semantic")]
 pub mod embedding;
 
-pub use intent::{Card, Intent, IntentName, IntentResponse};
-pub use recognizer::{
-    IntentRecognizer, RecognizerError, RegexIntentRecognizer, MAX_UTTERANCE_BYTES,
-};
-pub use semantic_recognizer::{SemanticIntentRecognizer, DEFAULT_SIMILARITY_THRESHOLD};
+pub use audio::{AudioChunk, AudioCodec, AudioError, AudioFormat};
 pub use handler::{
     HandlerError, HassCancelAll, HassLightSet, HassNevermind, HassTurnOff, HassTurnOn,
     IntentHandler,
 };
+pub use intent::{Card, Intent, IntentName, IntentResponse};
+pub use pipeline::AssistPipeline;
+pub use recognizer::{
+    IntentRecognizer, RecognizerError, RegexIntentRecognizer, MAX_UTTERANCE_BYTES,
+};
 pub use runner::{
     AssistError, LocalRunner, NoopRunner, RufloResponse, RufloRunner, RufloRunnerOpts,
 };
-pub use pipeline::AssistPipeline;
+pub use satellite::{
+    SatelliteClientMessage, SatelliteError, SatelliteServerMessage, SatelliteSession,
+    SatelliteState, SATELLITE_PROTOCOL_VERSION,
+};
+pub use semantic_recognizer::{SemanticIntentRecognizer, DEFAULT_SIMILARITY_THRESHOLD};
+pub use speech::{
+    DisabledStt, DisabledTts, SpeechError, SpeechToText, SynthesizedSpeech, TextToSpeech,
+    Transcript,
+};
+pub use voice::{VoiceError, VoicePipeline, VoiceResponse, DEFAULT_VOICE_TIMEOUT};
diff --git a/v2/crates/homecore-assist/src/satellite.rs b/v2/crates/homecore-assist/src/satellite.rs
new file mode 100644
index 00000000..3505e49e
--- /dev/null
+++ b/v2/crates/homecore-assist/src/satellite.rs
@@ -0,0 +1,250 @@
+//! Transport-independent satellite voice session protocol.
+//!
+//! Text frames use [`SatelliteClientMessage`] / [`SatelliteServerMessage`].
+//! Binary frames are accepted only while a stream is active.
+
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+use crate::audio::{AudioChunk, AudioError, AudioFormat, MAX_UTTERANCE_AUDIO_BYTES};
+
+pub const SATELLITE_PROTOCOL_VERSION: u16 = 1;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum SatelliteClientMessage {
+    Hello {
+        version: u16,
+        token: String,
+    },
+    Start {
+        language: String,
+        format: AudioFormat,
+    },
+    End,
+    Cancel,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum SatelliteServerMessage {
+    Ready { version: u16 },
+    Started,
+    Transcript { text: String, language: String },
+    Intent { response: crate::IntentResponse },
+    Audio { format: AudioFormat, bytes: usize },
+    Finished,
+    Error { code: String, message: String },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum SatelliteState {
+    AwaitingHello,
+    Idle,
+    Streaming,
+    Closed,
+}
+
+/// Strict state machine used by WebSocket or native satellite transports.
+pub struct SatelliteSession {
+    state: SatelliteState,
+    authenticated: bool,
+    audio: Vec<u8>,
+    format: Option<AudioFormat>,
+    language: Option<String>,
+}
+
+impl SatelliteSession {
+    pub fn new() -> Self {
+        Self {
+            state: SatelliteState::AwaitingHello,
+            authenticated: false,
+            audio: Vec::new(),
+            format: None,
+            language: None,
+        }
+    }
+
+    pub fn state(&self) -> SatelliteState {
+        self.state
+    }
+
+    /// Handle a control message. `authenticate` must perform constant-time
+    /// credential comparison; credentials are never retained by this session.
+    pub fn control(
+        &mut self,
+        message: SatelliteClientMessage,
+        authenticate: impl FnOnce(&str) -> bool,
+    ) -> Result<SatelliteServerMessage, SatelliteError> {
+        match (self.state, message) {
+            (SatelliteState::AwaitingHello, SatelliteClientMessage::Hello { version, token }) => {
+                if version != SATELLITE_PROTOCOL_VERSION {
+                    self.state = SatelliteState::Closed;
+                    return Err(SatelliteError::UnsupportedVersion(version));
+                }
+                if !authenticate(&token) {
+                    self.state = SatelliteState::Closed;
+                    return Err(SatelliteError::Unauthorized);
+                }
+                self.authenticated = true;
+                self.state = SatelliteState::Idle;
+                Ok(SatelliteServerMessage::Ready { version })
+            }
+            (SatelliteState::Idle, SatelliteClientMessage::Start { language, format })
+                if self.authenticated =>
+            {
+                if language.is_empty() || language.len() > 35 {
+                    return Err(SatelliteError::InvalidLanguage);
+                }
+                self.format = Some(format.validate()?);
+                self.language = Some(language);
+                self.audio.clear();
+                self.state = SatelliteState::Streaming;
+                Ok(SatelliteServerMessage::Started)
+            }
+            (SatelliteState::Streaming, SatelliteClientMessage::End) => {
+                if self.audio.is_empty() {
+                    return Err(SatelliteError::EmptyStream);
+                }
+                self.state = SatelliteState::Idle;
+                Ok(SatelliteServerMessage::Finished)
+            }
+            (SatelliteState::Streaming, SatelliteClientMessage::Cancel) => {
+                self.reset_stream();
+                Ok(SatelliteServerMessage::Finished)
+            }
+            (_, SatelliteClientMessage::Cancel) => {
+                self.reset_stream();
+                Ok(SatelliteServerMessage::Finished)
+            }
+            _ => Err(SatelliteError::InvalidSequence),
+        }
+    }
+
+    pub fn audio(&mut self, chunk: AudioChunk) -> Result<(), SatelliteError> {
+        if self.state != SatelliteState::Streaming {
+            return Err(SatelliteError::InvalidSequence);
+        }
+        if self.audio.len().saturating_add(chunk.as_bytes().len()) > MAX_UTTERANCE_AUDIO_BYTES {
+            self.reset_stream();
+            return Err(SatelliteError::AudioLimit);
+        }
+        self.audio.extend_from_slice(chunk.as_bytes());
+        Ok(())
+    }
+
+    pub fn take_utterance(&mut self) -> Option<(Vec<u8>, AudioFormat, String)> {
+        if self.state != SatelliteState::Idle || self.audio.is_empty() {
+            return None;
+        }
+        let audio = std::mem::take(&mut self.audio);
+        Some((audio, self.format.take()?, self.language.take()?))
+    }
+
+    fn reset_stream(&mut self) {
+        self.audio.clear();
+        self.format = None;
+        self.language = None;
+        self.state = if self.authenticated {
+            SatelliteState::Idle
+        } else {
+            SatelliteState::AwaitingHello
+        };
+    }
+}
+
+impl Default for SatelliteSession {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum SatelliteError {
+    #[error("satellite message is invalid in the current session state")]
+    InvalidSequence,
+    #[error("satellite protocol version {0} is unsupported")]
+    UnsupportedVersion(u16),
+    #[error("satellite authentication failed")]
+    Unauthorized,
+    #[error("invalid language tag")]
+    InvalidLanguage,
+    #[error("audio stream is empty")]
+    EmptyStream,
+    #[error("audio stream exceeded its size limit")]
+    AudioLimit,
+    #[error(transparent)]
+    Audio(#[from] AudioError),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::audio::AudioCodec;
+
+    fn format() -> AudioFormat {
+        AudioFormat {
+            codec: AudioCodec::PcmS16Le,
+            sample_rate: 16_000,
+            channels: 1,
+        }
+    }
+
+    #[test]
+    fn happy_path_preserves_audio_and_metadata() {
+        let mut session = SatelliteSession::new();
+        session
+            .control(
+                SatelliteClientMessage::Hello {
+                    version: 1,
+                    token: "secret".into(),
+                },
+                |token| token == "secret",
+            )
+            .unwrap();
+        session
+            .control(
+                SatelliteClientMessage::Start {
+                    language: "en-CA".into(),
+                    format: format(),
+                },
+                |_| false,
+            )
+            .unwrap();
+        session
+            .audio(AudioChunk::new(vec![1, 0, 2, 0]).unwrap())
+            .unwrap();
+        session
+            .control(SatelliteClientMessage::End, |_| false)
+            .unwrap();
+        let (audio, stored_format, language) = session.take_utterance().unwrap();
+        assert_eq!(audio, vec![1, 0, 2, 0]);
+        assert_eq!(stored_format, format());
+        assert_eq!(language, "en-CA");
+    }
+
+    #[test]
+    fn unauthenticated_stream_is_rejected_and_closed() {
+        let mut session = SatelliteSession::new();
+        let error = session
+            .control(
+                SatelliteClientMessage::Hello {
+                    version: 1,
+                    token: "wrong".into(),
+                },
+                |_| false,
+            )
+            .unwrap_err();
+        assert!(matches!(error, SatelliteError::Unauthorized));
+        assert_eq!(session.state(), SatelliteState::Closed);
+    }
+
+    #[test]
+    fn binary_before_start_is_rejected() {
+        let mut session = SatelliteSession::new();
+        let error = session
+            .audio(AudioChunk::new(vec![0, 0]).unwrap())
+            .unwrap_err();
+        assert!(matches!(error, SatelliteError::InvalidSequence));
+    }
+}
diff --git a/v2/crates/homecore-assist/src/speech.rs b/v2/crates/homecore-assist/src/speech.rs
new file mode 100644
index 00000000..886369a4
--- /dev/null
+++ b/v2/crates/homecore-assist/src/speech.rs
@@ -0,0 +1,87 @@
+//! Provider-neutral speech-to-text and text-to-speech contracts.
+
+use async_trait::async_trait;
+use thiserror::Error;
+
+use crate::audio::{AudioFormat, MAX_UTTERANCE_AUDIO_BYTES};
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Transcript {
+    pub text: String,
+    pub language: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SynthesizedSpeech {
+    pub audio: Vec<u8>,
+    pub format: AudioFormat,
+}
+
+#[derive(Debug, Error)]
+pub enum SpeechError {
+    #[error("{0} provider is not configured")]
+    NotConfigured(&'static str),
+    #[error("speech provider rejected the request: {0}")]
+    Provider(String),
+    #[error("speech provider returned invalid data: {0}")]
+    InvalidOutput(String),
+    #[error("speech operation timed out")]
+    Timeout,
+}
+
+#[async_trait]
+pub trait SpeechToText: Send + Sync {
+    async fn transcribe(
+        &self,
+        audio: &[u8],
+        format: AudioFormat,
+        language: &str,
+    ) -> Result<Transcript, SpeechError>;
+}
+
+#[async_trait]
+pub trait TextToSpeech: Send + Sync {
+    async fn synthesize(
+        &self,
+        text: &str,
+        language: &str,
+    ) -> Result<SynthesizedSpeech, SpeechError>;
+}
+
+/// Fail-closed provider used until an STT integration is configured.
+pub struct DisabledStt;
+
+#[async_trait]
+impl SpeechToText for DisabledStt {
+    async fn transcribe(
+        &self,
+        _audio: &[u8],
+        _format: AudioFormat,
+        _language: &str,
+    ) -> Result<Transcript, SpeechError> {
+        Err(SpeechError::NotConfigured("STT"))
+    }
+}
+
+/// Fail-closed provider used until a TTS integration is configured.
+pub struct DisabledTts;
+
+#[async_trait]
+impl TextToSpeech for DisabledTts {
+    async fn synthesize(
+        &self,
+        _text: &str,
+        _language: &str,
+    ) -> Result<SynthesizedSpeech, SpeechError> {
+        Err(SpeechError::NotConfigured("TTS"))
+    }
+}
+
+pub(crate) fn validate_provider_audio(audio: &[u8]) -> Result<(), SpeechError> {
+    if audio.is_empty() || audio.len() > MAX_UTTERANCE_AUDIO_BYTES || audio.len() % 2 != 0 {
+        return Err(SpeechError::InvalidOutput(
+            "audio must be non-empty, bounded, aligned PCM".into(),
+        ));
+    }
+    Ok(())
+}
diff --git a/v2/crates/homecore-assist/src/voice.rs b/v2/crates/homecore-assist/src/voice.rs
new file mode 100644
index 00000000..13c84fda
--- /dev/null
+++ b/v2/crates/homecore-assist/src/voice.rs
@@ -0,0 +1,183 @@
+//! End-to-end STT → intent → TTS pipeline.
+
+use std::time::Duration;
+
+use homecore::HomeCore;
+use thiserror::Error;
+use tokio::time::timeout;
+
+use crate::audio::{AudioFormat, MAX_UTTERANCE_AUDIO_BYTES};
+use crate::pipeline::AssistPipeline;
+use crate::recognizer::IntentRecognizer;
+use crate::speech::{
+    validate_provider_audio, SpeechError, SpeechToText, SynthesizedSpeech, TextToSpeech, Transcript,
+};
+use crate::{AssistError, IntentResponse};
+
+pub const DEFAULT_VOICE_TIMEOUT: Duration = Duration::from_secs(30);
+
+#[derive(Clone, Debug)]
+pub struct VoiceResponse {
+    pub transcript: Transcript,
+    pub intent: IntentResponse,
+    pub speech: SynthesizedSpeech,
+}
+
+#[derive(Debug, Error)]
+pub enum VoiceError {
+    #[error("input audio is empty or exceeds the utterance limit")]
+    InvalidAudio,
+    #[error(transparent)]
+    Speech(#[from] SpeechError),
+    #[error(transparent)]
+    Assist(#[from] AssistError),
+    #[error("voice pipeline timed out")]
+    Timeout,
+}
+
+pub struct VoicePipeline<S, T, R: IntentRecognizer> {
+    stt: S,
+    tts: T,
+    assist: AssistPipeline<R>,
+    timeout: Duration,
+}
+
+impl<S, T, R> VoicePipeline<S, T, R>
+where
+    S: SpeechToText,
+    T: TextToSpeech,
+    R: IntentRecognizer,
+{
+    pub fn new(stt: S, tts: T, assist: AssistPipeline<R>) -> Self {
+        Self {
+            stt,
+            tts,
+            assist,
+            timeout: DEFAULT_VOICE_TIMEOUT,
+        }
+    }
+
+    pub fn with_timeout(mut self, value: Duration) -> Self {
+        self.timeout = value;
+        self
+    }
+
+    pub async fn process(
+        &self,
+        audio: &[u8],
+        format: AudioFormat,
+        language: &str,
+        hc: &HomeCore,
+    ) -> Result<VoiceResponse, VoiceError> {
+        if audio.is_empty() || audio.len() > MAX_UTTERANCE_AUDIO_BYTES || audio.len() % 2 != 0 {
+            return Err(VoiceError::InvalidAudio);
+        }
+        let format = format.validate().map_err(|_| VoiceError::InvalidAudio)?;
+        timeout(self.timeout, async {
+            let transcript = self.stt.transcribe(audio, format, language).await?;
+            let intent = self
+                .assist
+                .process(&transcript.text, &transcript.language, hc)
+                .await?;
+            let speech = self
+                .tts
+                .synthesize(&intent.speech, &transcript.language)
+                .await?;
+            speech
+                .format
+                .validate()
+                .map_err(|error| SpeechError::InvalidOutput(error.to_string()))?;
+            validate_provider_audio(&speech.audio)?;
+            Ok(VoiceResponse {
+                transcript,
+                intent,
+                speech,
+            })
+        })
+        .await
+        .map_err(|_| VoiceError::Timeout)?
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use async_trait::async_trait;
+
+    use super::*;
+    use crate::audio::AudioCodec;
+    use crate::recognizer::RegexIntentRecognizer;
+    use crate::speech::{SpeechToText, TextToSpeech};
+
+    struct FixedStt;
+
+    #[async_trait]
+    impl SpeechToText for FixedStt {
+        async fn transcribe(
+            &self,
+            _audio: &[u8],
+            _format: AudioFormat,
+            language: &str,
+        ) -> Result<Transcript, SpeechError> {
+            Ok(Transcript {
+                text: "never mind".into(),
+                language: language.into(),
+            })
+        }
+    }
+
+    struct FixedTts;
+
+    #[async_trait]
+    impl TextToSpeech for FixedTts {
+        async fn synthesize(
+            &self,
+            text: &str,
+            _language: &str,
+        ) -> Result<SynthesizedSpeech, SpeechError> {
+            assert!(!text.is_empty());
+            Ok(SynthesizedSpeech {
+                audio: vec![0, 0, 1, 0],
+                format: format(),
+            })
+        }
+    }
+
+    fn format() -> AudioFormat {
+        AudioFormat {
+            codec: AudioCodec::PcmS16Le,
+            sample_rate: 16_000,
+            channels: 1,
+        }
+    }
+
+    #[tokio::test]
+    async fn runs_stt_intent_and_tts() {
+        let recognizer = RegexIntentRecognizer::new();
+        recognizer
+            .register("HassNevermind", r"never ?mind", "*")
+            .await
+            .unwrap();
+        let pipeline = crate::pipeline::default_pipeline(recognizer);
+        let voice = VoicePipeline::new(FixedStt, FixedTts, pipeline);
+        let result = voice
+            .process(&[0, 0, 1, 0], format(), "en-CA", &HomeCore::new())
+            .await
+            .unwrap();
+        assert_eq!(result.transcript.text, "never mind");
+        assert_eq!(result.speech.audio.len(), 4);
+    }
+
+    #[tokio::test]
+    async fn rejects_unaligned_audio_before_provider_call() {
+        let voice = VoicePipeline::new(
+            FixedStt,
+            FixedTts,
+            crate::pipeline::default_pipeline(RegexIntentRecognizer::new()),
+        );
+        let error = voice
+            .process(&[0], format(), "en", &HomeCore::new())
+            .await
+            .unwrap_err();
+        assert!(matches!(error, VoiceError::InvalidAudio));
+    }
+}

From 273bd449c8df285f5b5a8acd3b5211687b089521 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:07:06 -0400
Subject: [PATCH 02/16] feat(homecore-api): expose loaded components

---
 v2/crates/homecore-api/src/app.rs  |  1 +
 v2/crates/homecore-api/src/rest.rs | 39 ++++++++++++++++++++++++++----
 2 files changed, 35 insertions(+), 5 deletions(-)

diff --git a/v2/crates/homecore-api/src/app.rs b/v2/crates/homecore-api/src/app.rs
index 814d22ea..e7d094e7 100644
--- a/v2/crates/homecore-api/src/app.rs
+++ b/v2/crates/homecore-api/src/app.rs
@@ -27,6 +27,7 @@ pub fn router(state: SharedState) -> Router {
     Router::new()
         .route("/api/", get(rest::api_root))
         .route("/api/config", get(rest::get_config))
+        .route("/api/components", get(rest::get_components))
         .route("/api/states", get(rest::get_states))
         .route(
             "/api/states/:entity_id",
diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index 7e9fa451..89b5b190 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -44,6 +44,15 @@ pub struct ApiConfig {
     components: Vec<String>,
 }
 
+const LOADED_COMPONENTS: &[&str] = &[
+    "api",
+    "automation",
+    "config",
+    "homecore",
+    "recorder",
+    "websocket_api",
+];
+
 pub async fn get_config(
     headers: HeaderMap,
     State(s): State<SharedState>,
@@ -53,10 +62,26 @@ pub async fn get_config(
         location_name: s.location_name().to_string(),
         version: s.version().to_string(),
         state: "RUNNING",
-        components: vec![],
+        components: LOADED_COMPONENTS
+            .iter()
+            .map(|component| (*component).to_owned())
+            .collect(),
     }))
 }
 
+pub async fn get_components(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<Vec<String>>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    Ok(Json(
+        LOADED_COMPONENTS
+            .iter()
+            .map(|component| (*component).to_owned())
+            .collect(),
+    ))
+}
+
 #[derive(Serialize)]
 pub struct StateView {
     pub entity_id: String,
@@ -280,10 +305,14 @@ pub async fn fire_event(
     } else {
         body
     };
-    s.homecore()
-        .bus()
-        .fire_domain(homecore::DomainEvent::new(event_type, data, Context::new()));
-    Ok(Json(serde_json::json!({"message": "Event fired."})))
+    s.homecore().bus().fire_domain(homecore::DomainEvent::new(
+        event_type.clone(),
+        data,
+        Context::new(),
+    ));
+    Ok(Json(
+        serde_json::json!({"message": format!("Event {event_type} fired.")}),
+    ))
 }
 
 #[derive(Deserialize)]

From 3136f1305b47a8db23d4ab02abb810aeb1442e4b Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:09:17 -0400
Subject: [PATCH 03/16] feat(homecore-api): negotiate modern websocket clients

---
 v2/crates/homecore-api/src/rest.rs |  1 +
 v2/crates/homecore-api/src/ws.rs   | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index 89b5b190..5f60576e 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -381,6 +381,7 @@ pub async fn compatibility(
             "states_services_config": "implemented",
             "events": "implemented",
             "render_template": "implemented",
+            "feature_negotiation_and_panels": "implemented",
             "registries": "requires_registry_backend",
             "lovelace_media": "integration_dependent"
         }
diff --git a/v2/crates/homecore-api/src/ws.rs b/v2/crates/homecore-api/src/ws.rs
index 49bef4d4..b1c3c2b0 100644
--- a/v2/crates/homecore-api/src/ws.rs
+++ b/v2/crates/homecore-api/src/ws.rs
@@ -240,6 +240,12 @@ impl Connection {
 
     async fn handle_cmd(&self, cmd: WsCommand, tx: &tokio::sync::mpsc::Sender<String>) {
         match cmd.kind.as_str() {
+            "supported_features" => {
+                // HOMECORE currently emits individual messages. Accepting the
+                // negotiation command keeps modern HA clients compatible while
+                // deliberately declining optional coalescing.
+                self.ack(tx, cmd.id, true, None);
+            }
             "ping" => {
                 let msg = serde_json::json!({"id": cmd.id, "type": "pong"});
                 let _ = tx.try_send(msg.to_string());
@@ -258,6 +264,11 @@ impl Connection {
                 });
                 self.ack(tx, cmd.id, true, Some(payload));
             }
+            "get_panels" => {
+                // Panels are frontend integration resources. An empty map is
+                // the valid shape for a headless server.
+                self.ack(tx, cmd.id, true, Some(serde_json::json!({})));
+            }
             "get_services" => {
                 let services = self.state.homecore().services().registered_services().await;
                 let mut by_domain: std::collections::HashMap<

From 0a8e72e762f5ba2c92f83e6ede57c183b3fdbb8e Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:14:04 -0400
Subject: [PATCH 04/16] feat(homecore): complete migration and startup restore

---
 .../ADR-127-homecore-state-machine-rust.md    |   5 +
 ...mecore-recorder-history-semantic-search.md |   6 +
 ...65-homecore-migrate-from-home-assistant.md |  46 +-
 v2/Cargo.lock                                 |   2 +
 v2/crates/homecore-migrate/README.md          | 187 ++----
 v2/crates/homecore-migrate/src/cli.rs         |  19 +-
 .../homecore-migrate/src/config_entries.rs    | 352 +++++++++---
 .../homecore-migrate/src/device_registry.rs   | 226 +++++---
 .../homecore-migrate/src/entity_registry.rs   |  46 +-
 v2/crates/homecore-migrate/src/lib.rs         |  18 +-
 v2/crates/homecore-migrate/src/main.rs        |  78 ++-
 v2/crates/homecore-migrate/src/storage.rs     |  69 +++
 v2/crates/homecore-recorder/README.md         |   3 +
 v2/crates/homecore-recorder/src/db.rs         | 541 +++++++++++++++---
 v2/crates/homecore-recorder/src/lib.rs        |   5 +-
 v2/crates/homecore-server/Cargo.toml          |   4 +-
 v2/crates/homecore-server/README.md           |   7 +
 v2/crates/homecore-server/src/main.rs         |  58 +-
 v2/crates/homecore-server/src/restore.rs      | 219 +++++++
 v2/crates/homecore/src/event.rs               |  17 +
 v2/crates/homecore/src/homecore.rs            |   8 +-
 v2/crates/homecore/src/lib.rs                 |  17 +-
 v2/crates/homecore/src/registry.rs            |  80 ++-
 v2/crates/homecore/src/state.rs               |  20 +-
 24 files changed, 1552 insertions(+), 481 deletions(-)
 create mode 100644 v2/crates/homecore-server/src/restore.rs

diff --git a/docs/adr/ADR-127-homecore-state-machine-rust.md b/docs/adr/ADR-127-homecore-state-machine-rust.md
index 1887ed3f..4df20d0e 100644
--- a/docs/adr/ADR-127-homecore-state-machine-rust.md
+++ b/docs/adr/ADR-127-homecore-state-machine-rust.md
@@ -82,6 +82,11 @@ The entity registry is a `RwLock<HashMap<EntityId, EntityEntry>>` backed by an a
 
 `DeviceRegistry` mirrors HA's `core.device_registry` schema (version 13). Devices are identified by a set of `(id_type, id_value)` tuples (the `identifiers` field), which matches HA's pattern of accepting multiple identifier types per device (MAC address, serial number, integration-specific ID).
 
+`DeviceEntry` and the in-memory `DeviceRegistry` are implemented. On server
+startup, entity and device registry files are restored in deterministic key
+order with a configurable hard row bound; malformed individual entries are
+isolated and reported.
+
 ---
 
 ## 3. HA-side reference table
diff --git a/docs/adr/ADR-132-homecore-recorder-history-semantic-search.md b/docs/adr/ADR-132-homecore-recorder-history-semantic-search.md
index d1b75fe7..1bfb7c09 100644
--- a/docs/adr/ADR-132-homecore-recorder-history-semantic-search.md
+++ b/docs/adr/ADR-132-homecore-recorder-history-semantic-search.md
@@ -148,6 +148,12 @@ correctness, fail-closed write integrity, semantic-store NaN poisoning, and PII
 - **Memory-DoS — `get_state_history` was unbounded.** No `LIMIT`, so a wide time window over a
   high-frequency entity loaded an unbounded row set into memory. Now capped at
   `MAX_HISTORY_ROWS` (1,000,000); sibling search paths were already `k`-bounded.
+- **Startup state restoration.** `latest_states(limit)` selects one newest row
+  per entity with `(last_updated_ts, state_id)` tie-breaking, orders results by
+  entity ID, and caps requests at 100,000. Malformed rows are skipped with
+  typed warnings. `restore_latest` preserves recorded timestamps and installs
+  snapshots with a `homecore.restore` context before the recorder listener and
+  automation engine start.
 - **Disk-DoS / documented-but-missing `purge`.** The README advertised `Recorder::purge`, but
   no retention path existed → unbounded disk growth. Added a **transactional** `purge(older_than)`
   with an **exclusive** cutoff (idempotent, no off-by-one) that deletes old `states`/`events` and
diff --git a/docs/adr/ADR-165-homecore-migrate-from-home-assistant.md b/docs/adr/ADR-165-homecore-migrate-from-home-assistant.md
index 4f68b231..d9e95c03 100644
--- a/docs/adr/ADR-165-homecore-migrate-from-home-assistant.md
+++ b/docs/adr/ADR-165-homecore-migrate-from-home-assistant.md
@@ -2,7 +2,7 @@
 
 | Field | Value |
 |-------|-------|
-| **Status** | Accepted — P1 scaffold (full conversion deferred to P2) |
+| **Status** | Accepted — registry/config persistence implemented |
 | **Date** | 2026-05-25 |
 | **Deciders** | ruv |
 | **Codename** | **HOMECORE-MIGRATE** |
@@ -44,8 +44,8 @@ files are read, how schema versions are validated, and what happens on an unknow
 ## 2. Decision
 
 Ship `homecore-migrate` as a CLI + library that reads an existing HA filesystem and imports
-its configuration into HOMECORE. P1 is a **scaffold**: it parses and inspects everything and
-converts the entity registry; full conversion of the remaining artifacts is deferred to P2.
+its configuration into HOMECORE. Registry and config-entry conversion are durable; automation
+conversion and secret-reference resolution remain deferred.
 
 ### 2.1 Storage reader + versioned format gate (P1, shipped)
 
@@ -57,22 +57,25 @@ converts the entity registry; full conversion of the remaining artifacts is defe
   unknown `minor_version` is a **hard error** (`MigrateError::UnsupportedSchemaVersion`),
   never a silent best-effort parse. Better to refuse than to corrupt.
 
-### 2.2 Per-artifact parsers (P1, shipped)
+### 2.2 Per-artifact conversion (shipped)
 
 - `entity_registry::load()` — `core.entity_registry` → `Vec<homecore::EntityEntry>`
   (ready for import).
-- `device_registry::load()` — `core.device_registry` → `Vec<DeviceImport>` (P1 diagnostic;
-  full conversion P2).
-- `config_entries::load()` — `core.config_entries` → domain counts + integration names
-  (the format is undocumented per §6 Q5; treated diagnostically).
+- `device_registry::read_device_registry()` converts the supported v13 device fields into
+  `homecore::DeviceEntry`; `write_device_registry()` emits an HA-compatible v13 envelope.
+- `config_entries::convert_config_entries()` emits versioned `homecore.config_entries`
+  storage. Original rows are retained verbatim, while unsupported domains and fields produce
+  typed warnings instead of being discarded.
 - `secrets::load_secrets()` — `secrets.yaml` → `HashMap<String, String>` (resolution P2).
 - `automations::load()` — `automations.yaml` → count + ID/alias list (conversion P2).
 
-### 2.3 CLI (P1, shipped)
+### 2.3 CLI
 
 - `homecore-migrate inspect <ha-dir>` previews what will be migrated (entity/device/config
   counts, redacted secret/automation lists) (`src/cli.rs`, `src/main.rs`).
-- `import-entities` and `export-for-sidecar` are declared but their full behaviour is P2.
+- `import-entities`, `import-devices`, and `import-config-entries` write destination files and
+  emit one-line JSON summaries. Writes use synced same-directory temporary files and atomic
+  no-clobber publication; an existing destination is never implicitly replaced.
 
 ### 2.4 Structured errors (P1, shipped)
 
@@ -88,27 +91,25 @@ converts the entity registry; full conversion of the remaining artifacts is defe
   file path and a coarse location (`serde_yaml::Error::location()`), never the scalar content.
   Pinned by `secrets::tests::malformed_secrets_error_never_contains_secret_value` (asserts the
   rendered error **and its full `#[source]` chain** never contain the secret value).
-  **Review dimensions confirmed clean with evidence:** source is never mutated (no
-  `fs::write`/`remove`/`create` anywhere — P1 reads source, writes nothing); paths are
+  **Review dimensions confirmed clean with evidence:** source is never mutated; destination
+  writes are explicit `--to` paths and no-clobber; paths are
   user-supplied dirs joined with fixed filenames (no `..`/absolute traversal beyond the
   user's own privileges); malformed/typed/truncated `.storage` JSON and YAML **error, never
   panic** (every production `unwrap`/`expect` is test-only); unknown schema `minor_version`
-  hard-errors fail-closed; no SQL/shell/path injection surface (the tool emits diagnostics
-  only, persists nothing in P1).
+  hard-errors fail-closed; no SQL/shell injection surface.
 
 ### 2.5 Deferred to P2+ (NOT built — honestly labelled)
 
-- Convert `config_entries` → HOMECORE plugin manifests.
+- Execute imported config entries (a matching HOMECORE plugin must claim the preserved domain).
 - Convert `automations.yaml` → `homecore-automation` YAML.
 - Side-by-side runtime mode (requires `homecore-recorder`, ADR-132; behind the `recorder`
   Cargo feature, currently a no-op stub).
 - `!secret` reference resolution in non-secrets YAML files.
 
-### 2.6 Test evidence (as shipped)
+### 2.6 Test evidence
 
-- 21 tests (`cargo test -p homecore-migrate`) — 19 as originally shipped plus 2 added by the
-  2026-06 security review (`secrets::tests::malformed_secrets_error_never_contains_secret_value`,
-  `malformed_secrets_error_reports_location`).
+- Targeted tests cover registry round trips, unknown versions, lossless unsupported config
+  fields/domains, malformed input, and crash-safe/no-overwrite destination behaviour.
 
 ## 3. Consequences
 
@@ -118,13 +119,12 @@ converts the entity registry; full conversion of the remaining artifacts is defe
   schema drift fails loudly instead of corrupting an imported home.
 - Reusing HA's own `.storage` and YAML formats means no intermediate export step; the tool
   reads a live HA install directly.
-- P1 `inspect` gives users a no-risk dry run before any write.
+- `inspect` gives users a no-risk dry run before any write.
 
 **Negative / honest limits.**
 
-- P1 is a **scaffold**: only the entity registry is conversion-ready. Device registry,
-  config-entry→plugin, automation, and secret-resolution conversions are P2 and **not yet
-  built** — the Status field and crate docs say so.
+- Imported config entries are durable but do not install or execute Python HA integrations.
+- Automation conversion and secret-reference resolution are not built.
 - The side-by-side recorder export depends on ADR-132 and is currently a feature-gated
   no-op.
 - Performance figures in the README (envelope parse < 5 ms, 1 000-entity load < 50 ms) are
diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index e77e05f1..5f0b13fa 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -3675,6 +3675,7 @@ dependencies = [
  "homecore-api",
  "homecore-assist",
  "homecore-automation",
+ "homecore-migrate",
  "homecore-plugins",
  "homecore-recorder",
  "http-body-util",
@@ -3682,6 +3683,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
+ "tempfile",
  "tokio",
  "tower 0.5.3",
  "tower-http",
diff --git a/v2/crates/homecore-migrate/README.md b/v2/crates/homecore-migrate/README.md
index 54b98441..b1e6ec20 100644
--- a/v2/crates/homecore-migrate/README.md
+++ b/v2/crates/homecore-migrate/README.md
@@ -1,144 +1,77 @@
 # homecore-migrate
 
-Migration tooling for importing Home Assistant configuration, entities, and secrets into HOMECORE.
+Migration tooling for importing Home Assistant filesystem storage into
+HOMECORE. The implementation follows
+[ADR-165](../../docs/adr/ADR-165-homecore-migrate-from-home-assistant.md).
 
-[![Crates.io](https://img.shields.io/crates/v/homecore-migrate.svg)](https://crates.io/crates/homecore-migrate)
-![License](https://img.shields.io/badge/license-MIT-blue.svg)
-![MSRV: 1.89+](https://img.shields.io/badge/MSRV-1.89%2B-purple.svg)
-[![Tests](https://img.shields.io/badge/tests-19%20passing-brightgreen.svg)](https://github.com/ruvnet/RuView)
-[![ADR-165](https://img.shields.io/badge/ADR-165-orange.svg)](../../docs/adr/ADR-165-homecore-migrate-from-home-assistant.md)
+## Implemented
 
-Parse and inspect Home Assistant's `.storage/` directory, entity registry, device registry, secrets, and automations. Convert existing HA configurations for import into HOMECORE (full conversion in P2).
+- Reads versioned HA `.storage` JSON and rejects unknown schema versions.
+- Converts entity registry metadata to `homecore::EntityEntry`.
+- Converts the supported HA v13 device-registry fields to
+  `homecore::DeviceEntry`, including identifiers, connections, versions,
+  serial number, labels, topology, and config-entry links.
+- Converts `core.config_entries` to a versioned
+  `homecore.config_entries` file. Each original row is retained verbatim.
+  Unsupported domains and non-portable fields produce typed warnings.
+- Publishes destination JSON through a synced same-directory temporary file
+  and an atomic no-clobber link. Existing destination files are never replaced.
+- Emits one-line JSON summaries from every import command.
+- Parses secrets with redacted errors and inspects automations.
 
-## What this crate does
+## CLI
 
-`homecore-migrate` reads Home Assistant's filesystem state and provides tooling to analyze and migrate it to HOMECORE. It includes:
-
-- **HaStorageDir** — reads HA's `.homeassistant/.storage/` directory and parses versioned JSON envelopes
-- **Entity registry parser** — converts `core.entity_registry` JSON to HOMECORE `EntityEntry` types
-- **Device registry parser** — reads `core.device_registry` (P1 diagnostic only; full conversion in P2)
-- **Config entries parser** — reads `core.config_entries` to list active integrations
-- **Secrets parser** — reads `secrets.yaml` as `HashMap<String, String>` for reference resolution (P2)
-- **Automations parser** — reads `automations.yaml` and counts/lists automations (full conversion in P2)
-- **CLI binary** — `homecore-migrate inspect` to preview what will be migrated
-
-The tool enforces version schema compatibility: unknown HA schema versions are rejected (hard error per ADR-165 §6 Q5) rather than silently corrupting data.
-
-## Features
-
-- **Entity registry import** — `core.entity_registry` → an atomically written,
-  HA-compatible HOMECORE registry file; existing destinations are not overwritten
-- **Device registry inspection** — read HA device metadata; full conversion deferred to P2
-- **Config entries analysis** — list active integrations by domain (enables gap analysis)
-- **Secrets extraction** — read `secrets.yaml` references for annotation (resolution in P2)
-- **Automations counting** — list automation IDs and aliases without conversion (conversion in P2)
-- **Schema version validation** — explicit rejection of unknown HA versions (no silent corruption)
-- **Structured error reporting** — `MigrateError` enum with context (file path, line number)
-- **CLI subcommands** — `inspect` to preview, `import-entities` to load (P2), `export-for-sidecar` (P2)
-
-## Capabilities
-
-| Capability | Type | Method | Notes |
-|------------|------|--------|-------|
-| Read storage envelope | Parser | `storage::read_envelope(path)` | Deserialize `.storage/*.json` |
-| Parse entity registry | Parser | `entity_registry::load(storage_dir)` | → `Vec<homecore::EntityEntry>` |
-| Inspect device registry | Parser | `device_registry::load(storage_dir)` | → `Vec<DeviceImport>` (P1 diagnostic) |
-| List config entries | Parser | `config_entries::load(storage_dir)` | → domain counts + names |
-| Load secrets | Parser | `secrets::load_secrets(path)` | → `HashMap<String, String>` |
-| Count automations | Parser | `automations::load(path)` | → count + ID list |
-| Validate schema version | Validator | `storage_format::validate_version(major, minor)` | Hard error if unknown |
-| Convert to HOMECORE | Converter | `entity_registry::to_homecore_entries()` (P2) | → `homecore::EntityRegistry` |
-| Export side-by-side DB | Exporter | `recorder::export_states()` (P2, `--features recorder`) | → `.homecore/home.db` |
-
-## Comparison to Home Assistant
-
-| Aspect | Home Assistant | homecore-migrate |
-|--------|----------------|-----------------|
-| State source | Python `.homeassistant/` directory | Same HA filesystem format |
-| Entity registry format | JSON envelope in `.storage/core.entity_registry` | Identical format, schema v13 |
-| Schema versioning | `version` + optional `minor_version` | Explicit version struct validation |
-| Secrets resolution | `!secret` YAML references via loader | Planned P2 (reads `secrets.yaml`) |
-| Automation conversion | Python → HA YAML (internal) | P2: convert to `homecore-automation` format |
-| Device registry import | Python device types | P1 diagnostic; full conversion P2 |
-| Side-by-side runtime | N/A (HA doesn't side-by-side migrate) | P2 feature: run old + new in parallel |
-| CLI tooling | HA doesn't export | `homecore-migrate` binary with subcommands |
-
-## Performance
-
-- **Storage envelope parse** — < 5 ms per file (serde_json)
-- **Entity registry load** — < 50 ms for 1,000 entities
-- **Storage directory scan** — < 100 ms for full `.storage/` directory
-- **Secrets file parse** — < 10 ms (YAML)
-- **No per-crate benchmarks yet** — a follow-up issue tracks baseline measurements
-
-## Usage
-
-CLI inspection (P1):
+The import commands take the HA `.storage` directory and the HOMECORE storage
+destination:
 
 ```bash
-# Inspect what will be migrated from an existing HA installation
-homecore-migrate inspect ~/.homeassistant
+homecore-migrate import-entities \
+  --storage ~/.homeassistant/.storage \
+  --to ~/.homecore/storage
 
-# Output:
-# Entity Registry: 47 entities
-#   light: 12
-#   sensor: 20
-#   binary_sensor: 10
-#   switch: 5
-# Device Registry: 8 devices
-# Config Entries: 6 integrations (mqtt, rest, zeroconf, ...)
-# Secrets: 3 defined (redacted)
-# Automations: 5 automations (redacted)
+homecore-migrate import-devices \
+  --storage ~/.homeassistant/.storage \
+  --to ~/.homecore/storage
+
+homecore-migrate import-config-entries \
+  --storage ~/.homeassistant/.storage \
+  --to ~/.homecore/storage
 ```
 
-Programmatic entity import (P1):
+Successful imports print a machine-readable JSON object:
 
-```rust
-use homecore_migrate::entity_registry;
-use homecore::HomeCore;
-
-#[tokio::main]
-async fn main() {
-    let storage_dir = std::path::Path::new("/home/user/.homeassistant/.storage");
-    
-    // Load HA entities
-    let entries = entity_registry::load(storage_dir)
-        .expect("load entity registry");
-    println!("Loaded {} entities", entries.len());
-    
-    // Import into HOMECORE (P2 when EntityRegistry::import() lands)
-    let homecore = HomeCore::new();
-    for entry in entries {
-        println!("Entity: {} ({})", entry.entity_id, entry.name);
-    }
-}
+```json
+{"kind":"device_registry","imported":8,"warning_count":0,"warnings":[],"destination":"/home/user/.homecore/storage/core.device_registry"}
 ```
 
-Full migration (P2 onwards, via `--features recorder`):
+`inspect`, `inspect-config-entries`, `inspect-secrets`, and
+`inspect-automations` are read-only.
+
+## Destination files
+
+| Source | Destination | Format |
+|---|---|---|
+| `core.entity_registry` | `core.entity_registry` | HA-compatible v1/minor 13 envelope |
+| `core.device_registry` | `core.device_registry` | HA-compatible v1/minor 13 envelope |
+| `core.config_entries` | `homecore.config_entries` | HOMECORE v1/minor 0 envelope |
+
+Config entries are storage-compatible, not runtime-compatible: importing an
+entry does not install or execute its HA integration. A HOMECORE plugin must
+explicitly claim the domain and consume the preserved source payload.
+
+## Remaining limitations
+
+- Automation conversion is not implemented; the tool only inspects
+  `automations.yaml`.
+- `!secret` reference resolution in other YAML files is not implemented.
+- Deleted entity/device tombstones are not imported.
+- Device fields newer than HA registry minor version 13 require an explicit
+  parser update; unknown versions fail closed.
+- No side-by-side HA recorder database exporter is provided.
+
+## Validation
 
 ```bash
-# Side-by-side: old HA continues running while HOMECORE reads the DB
-homecore-migrate export-for-sidecar \
-  --ha-dir ~/.homeassistant \
-  --homecore-db ~/.homecore/home.db \
-  --keep-automations true  # Don't stop HA automations during test period
+cargo test -p homecore-migrate
+cargo clippy -p homecore-migrate --all-targets -- -D warnings
 ```
-
-## Relation to other HOMECORE crates
-
-```
-homecore-migrate (import from HA)
-├─ homecore (EntityEntry → EntityRegistry; config entry imports)
-├─ homecore-automation (automations.yaml → automation rules, P2)
-├─ homecore-recorder (side-by-side state export, P2, `--features recorder`)
-├─ homecore-plugins (config_entries → plugin manifests, P2)
-└─ homecore-server (can auto-import at startup with --import-ha flag, P2)
-```
-
-## References
-
-- [ADR-165: HOMECORE Migration from Python Home Assistant](../../docs/adr/ADR-165-homecore-migrate-from-home-assistant.md)
-- [ADR-126: HOMECORE Home Assistant Port (master)](../../docs/adr/ADR-126-homecore-home-assistant-port.md)
-- [Home Assistant .storage/ format](https://developers.home-assistant.io/docs/storage/)
-- [homecore-migrate CLI source](src/main.rs)
-- [README — wifi-densepose](../../../README.md)
diff --git a/v2/crates/homecore-migrate/src/cli.rs b/v2/crates/homecore-migrate/src/cli.rs
index 4a2fc7ba..30d73cdf 100644
--- a/v2/crates/homecore-migrate/src/cli.rs
+++ b/v2/crates/homecore-migrate/src/cli.rs
@@ -21,10 +21,12 @@ pub enum Command {
     Inspect(InspectArgs),
     /// Import entity registry from HA into a HOMECORE storage directory.
     ImportEntities(ImportEntitiesArgs),
-    /// Import device registry (P1: parses and reports; wiring to HOMECORE P2).
+    /// Import the device registry into HOMECORE storage.
     ImportDevices(ImportDevicesArgs),
-    /// Inspect config entries (P1: count + domain list; conversion is P2).
+    /// Inspect config entries without writing.
     InspectConfigEntries(InspectConfigEntriesArgs),
+    /// Import config entries losslessly into versioned HOMECORE storage.
+    ImportConfigEntries(ImportConfigEntriesArgs),
     /// Parse secrets.yaml and report secret names (values redacted).
     InspectSecrets(InspectSecretsArgs),
     /// Count and list automations from automations.yaml (conversion is P2).
@@ -53,6 +55,19 @@ pub struct ImportDevicesArgs {
     /// Path to the HA `.storage/` directory.
     #[arg(long)]
     pub storage: PathBuf,
+    /// Path to the HOMECORE storage directory (destination).
+    #[arg(long)]
+    pub to: PathBuf,
+}
+
+#[derive(Debug, clap::Args)]
+pub struct ImportConfigEntriesArgs {
+    /// Path to the HA `.storage/` directory.
+    #[arg(long)]
+    pub storage: PathBuf,
+    /// Path to the HOMECORE storage directory (destination).
+    #[arg(long)]
+    pub to: PathBuf,
 }
 
 #[derive(Debug, clap::Args)]
diff --git a/v2/crates/homecore-migrate/src/config_entries.rs b/v2/crates/homecore-migrate/src/config_entries.rs
index 8144f685..855595e7 100644
--- a/v2/crates/homecore-migrate/src/config_entries.rs
+++ b/v2/crates/homecore-migrate/src/config_entries.rs
@@ -1,84 +1,236 @@
-//! Parser for `core.config_entries` (HA storage schema v1, minor_version varies).
+//! Lossless conversion of HA `core.config_entries` into HOMECORE storage.
 //!
-//! Per ADR-165 §6 Q5, `.storage/core.config_entries` format is undocumented
-//! and version-gated. P1 reads the envelope and emits:
-//!   - count of config entries
-//!   - list of integration domains represented
-//!
-//! Conversion to HOMECORE plugin manifests is P2.
-//!
-//! Note: `config_entries` uses a different `minor_version` track from
-//! `entity_registry`. As of HA 2025.1 it is typically minor_version=1 or 2.
-//! We accept any minor_version ≤ MAX_SUPPORTED_MINOR and hard-error above it.
+//! HOMECORE cannot yet execute arbitrary HA integrations. Every source row is
+//! therefore retained verbatim while portable identity/config fields are
+//! projected for future plugin setup. Typed warnings make the unsupported
+//! surface machine-readable instead of silently dropping it.
 
-use std::path::Path;
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
 
 use serde::{Deserialize, Serialize};
 
-use crate::{storage::read_envelope, MigrateError};
+use crate::{
+    storage::{read_envelope, write_json_atomic_noclobber, HaStorageEnvelope},
+    MigrateError,
+};
 
-/// Maximum `minor_version` we claim to understand for config_entries.
+const SOURCE_KEY: &str = "core.config_entries";
+pub const DESTINATION_KEY: &str = "homecore.config_entries";
 const MAX_SUPPORTED_MINOR: u32 = 4;
+const HOMECORE_CONFIG_VERSION: u32 = 1;
 
-/// Diagnostic summary produced by P1 inspection.
-#[derive(Clone, Debug, Serialize)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HomeCoreConfigEntry {
+    pub entry_id: String,
+    pub domain: String,
+    pub title: String,
+    #[serde(default)]
+    pub data: serde_json::Value,
+    /// Exact HA row, including unsupported and future fields.
+    pub source: serde_json::Value,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(tag = "code", rename_all = "snake_case")]
+pub enum MigrationWarning {
+    UnsupportedDomain { entry_id: String, domain: String },
+    UnsupportedField { entry_id: String, field: String },
+    UnsupportedRootField { field: String },
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HomeCoreConfigData {
+    pub source_version: u32,
+    pub source_minor_version: u32,
+    /// Exact non-entry fields from the HA `data` object.
+    #[serde(default)]
+    pub source_extra: BTreeMap<String, serde_json::Value>,
+    pub entries: Vec<HomeCoreConfigEntry>,
+    pub warnings: Vec<MigrationWarning>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HomeCoreConfigEnvelope {
+    pub version: u32,
+    pub minor_version: u32,
+    pub key: String,
+    pub data: HomeCoreConfigData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct ConfigEntriesSummary {
     pub count: usize,
     pub domains: Vec<String>,
+    pub warning_count: usize,
+    pub destination: Option<PathBuf>,
 }
 
-/// Minimal fields we read from each config-entry row.
-#[derive(Debug, Deserialize)]
-struct HaConfigEntryRow {
-    domain: String,
-    #[allow(dead_code)]
-    entry_id: String,
-    /// Title shown in HA UI (informational only in P1).
-    #[serde(default)]
-    #[allow(dead_code)]
-    title: Option<String>,
-    /// Source of the entry: "user" | "discovery" | "import" etc.
-    #[serde(default)]
-    #[allow(dead_code)]
-    source: Option<String>,
-    /// State: "loaded" | "setup_error" etc.
-    #[serde(default)]
-    #[allow(dead_code)]
-    state: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-struct HaConfigEntriesData {
-    entries: Vec<HaConfigEntryRow>,
-}
-
-/// Read `core.config_entries` from `path` and return a diagnostic summary.
-pub fn inspect_config_entries(path: &Path) -> Result<ConfigEntriesSummary, MigrateError> {
-    let env = read_envelope(path)?;
-    let file_str = path.display().to_string();
-
-    // config_entries has version=1 and minor_version in 1..MAX_SUPPORTED_MINOR.
+fn validate_source(env: &HaStorageEnvelope, path: &Path) -> Result<(), MigrateError> {
     if env.version != 1 || env.minor_version > MAX_SUPPORTED_MINOR {
         return Err(MigrateError::UnsupportedSchemaVersion {
-            file: file_str.clone(),
+            file: path.display().to_string(),
             version: env.version,
             minor_version: env.minor_version,
         });
     }
+    if env.key != SOURCE_KEY {
+        return Err(MigrateError::UnexpectedStorageKey {
+            path: path.display().to_string(),
+            expected: SOURCE_KEY.to_owned(),
+            actual: env.key.clone(),
+        });
+    }
+    Ok(())
+}
 
-    let data: HaConfigEntriesData =
-        serde_json::from_value(env.data).map_err(|e| MigrateError::JsonParse {
-            path: file_str,
-            source: e,
+pub fn convert_config_entries(path: &Path) -> Result<HomeCoreConfigEnvelope, MigrateError> {
+    let env = read_envelope(path)?;
+    validate_source(&env, path)?;
+    let entries = env
+        .data
+        .get("entries")
+        .and_then(serde_json::Value::as_array)
+        .ok_or_else(|| MigrateError::MissingField {
+            field: "entries".to_owned(),
+            context: path.display().to_string(),
         })?;
+    let source_extra: BTreeMap<String, serde_json::Value> = env
+        .data
+        .as_object()
+        .into_iter()
+        .flat_map(|object| object.iter())
+        .filter(|(field, _)| field.as_str() != "entries")
+        .map(|(field, value)| (field.clone(), value.clone()))
+        .collect();
 
-    let mut domains: Vec<String> = data.entries.iter().map(|e| e.domain.clone()).collect();
-    domains.sort();
-    domains.dedup();
+    let portable = BTreeSet::from(["entry_id", "domain", "title", "data"]);
+    let mut converted = Vec::with_capacity(entries.len());
+    let mut warnings = source_extra
+        .keys()
+        .map(|field| MigrationWarning::UnsupportedRootField {
+            field: field.clone(),
+        })
+        .collect::<Vec<_>>();
+    for (index, source) in entries.iter().enumerate() {
+        let object = source
+            .as_object()
+            .ok_or_else(|| MigrateError::MissingField {
+                field: "object row".to_owned(),
+                context: format!("{} data.entries[{index}]", path.display()),
+            })?;
+        let string_field = |field: &str| -> Result<String, MigrateError> {
+            object
+                .get(field)
+                .and_then(serde_json::Value::as_str)
+                .map(str::to_owned)
+                .ok_or_else(|| MigrateError::MissingField {
+                    field: field.to_owned(),
+                    context: format!("{} data.entries[{index}]", path.display()),
+                })
+        };
+        let entry_id = string_field("entry_id")?;
+        let domain = string_field("domain")?;
+        let title = object
+            .get("title")
+            .and_then(serde_json::Value::as_str)
+            .unwrap_or(&domain)
+            .to_owned();
+        let data = object
+            .get("data")
+            .cloned()
+            .unwrap_or_else(|| serde_json::json!({}));
 
+        // No HA domain is implicitly claimed executable by HOMECORE. The
+        // source is retained so a matching plugin can consume it later.
+        warnings.push(MigrationWarning::UnsupportedDomain {
+            entry_id: entry_id.clone(),
+            domain: domain.clone(),
+        });
+        for field in object
+            .keys()
+            .filter(|field| !portable.contains(field.as_str()))
+        {
+            warnings.push(MigrationWarning::UnsupportedField {
+                entry_id: entry_id.clone(),
+                field: field.clone(),
+            });
+        }
+        converted.push(HomeCoreConfigEntry {
+            entry_id,
+            domain,
+            title,
+            data,
+            source: source.clone(),
+        });
+    }
+    warnings.sort_by_key(|warning| serde_json::to_string(warning).unwrap_or_default());
+
+    Ok(HomeCoreConfigEnvelope {
+        version: HOMECORE_CONFIG_VERSION,
+        minor_version: 0,
+        key: DESTINATION_KEY.to_owned(),
+        data: HomeCoreConfigData {
+            source_version: env.version,
+            source_minor_version: env.minor_version,
+            source_extra,
+            entries: converted,
+            warnings,
+        },
+    })
+}
+
+pub fn write_config_entries(
+    storage_dir: &Path,
+    envelope: &HomeCoreConfigEnvelope,
+) -> Result<PathBuf, MigrateError> {
+    let target = storage_dir.join(DESTINATION_KEY);
+    write_json_atomic_noclobber(&target, envelope)
+}
+
+pub fn read_homecore_config_entries(path: &Path) -> Result<HomeCoreConfigEnvelope, MigrateError> {
+    let raw = std::fs::read_to_string(path).map_err(|source| MigrateError::Io {
+        path: path.display().to_string(),
+        source,
+    })?;
+    let envelope: HomeCoreConfigEnvelope =
+        serde_json::from_str(&raw).map_err(|source| MigrateError::JsonParse {
+            path: path.display().to_string(),
+            source,
+        })?;
+    if envelope.version != HOMECORE_CONFIG_VERSION || envelope.minor_version != 0 {
+        return Err(MigrateError::UnsupportedSchemaVersion {
+            file: path.display().to_string(),
+            version: envelope.version,
+            minor_version: envelope.minor_version,
+        });
+    }
+    if envelope.key != DESTINATION_KEY {
+        return Err(MigrateError::UnexpectedStorageKey {
+            path: path.display().to_string(),
+            expected: DESTINATION_KEY.to_owned(),
+            actual: envelope.key,
+        });
+    }
+    Ok(envelope)
+}
+
+pub fn inspect_config_entries(path: &Path) -> Result<ConfigEntriesSummary, MigrateError> {
+    let converted = convert_config_entries(path)?;
+    let domains: BTreeMap<&str, usize> =
+        converted
+            .data
+            .entries
+            .iter()
+            .fold(BTreeMap::new(), |mut map, entry| {
+                *map.entry(entry.domain.as_str()).or_default() += 1;
+                map
+            });
     Ok(ConfigEntriesSummary {
-        count: data.entries.len(),
-        domains,
+        count: converted.data.entries.len(),
+        domains: domains.keys().map(|value| (*value).to_owned()).collect(),
+        warning_count: converted.data.warnings.len(),
+        destination: None,
     })
 }
 
@@ -89,40 +241,70 @@ mod tests {
     use tempfile::NamedTempFile;
 
     const FIXTURE: &str = r#"{
-        "version": 1,
-        "minor_version": 1,
-        "key": "core.config_entries",
-        "data": {
-            "entries": [
-                {"domain": "hue", "entry_id": "ce_001", "title": "Philips Hue", "source": "user", "state": "loaded"},
-                {"domain": "zha",  "entry_id": "ce_002", "title": "ZHA",         "source": "user", "state": "loaded"},
-                {"domain": "hue",  "entry_id": "ce_003", "title": "Hue 2",       "source": "user", "state": "setup_error"}
-            ]
-        }
+      "version":1,"minor_version":2,"key":"core.config_entries",
+      "data":{"future_root":{"kept":true},"entries":[{
+        "domain":"future_hub","entry_id":"ce_001","title":"Future Hub",
+        "source":"user","state":"loaded","data":{"host":"10.0.0.2"},
+        "options":{"scan":true},"future_field":{"nested":[1,2,3]}
+      }]}
     }"#;
 
-    #[test]
-    fn inspect_emits_count_and_domains() {
-        let mut f = NamedTempFile::new().unwrap();
-        f.write_all(FIXTURE.as_bytes()).unwrap();
-        let summary = inspect_config_entries(f.path()).unwrap();
-        assert_eq!(summary.count, 3);
-        assert_eq!(summary.domains, vec!["hue", "zha"]);
+    fn fixture() -> NamedTempFile {
+        let mut file = NamedTempFile::new().unwrap();
+        file.write_all(FIXTURE.as_bytes()).unwrap();
+        file
     }
 
     #[test]
-    fn unknown_minor_version_hard_errors() {
-        let json = r#"{
-            "version": 1, "minor_version": 99,
-            "key": "core.config_entries",
-            "data": {"entries": []}
-        }"#;
-        let mut f = NamedTempFile::new().unwrap();
-        f.write_all(json.as_bytes()).unwrap();
-        let err = inspect_config_entries(f.path()).unwrap_err();
+    fn unknown_domain_and_fields_are_lossless_with_typed_warnings() {
+        let source = fixture();
+        let converted = convert_config_entries(source.path()).unwrap();
+        assert_eq!(
+            converted.data.entries[0].source["future_field"]["nested"][2],
+            3
+        );
+        assert_eq!(converted.data.source_extra["future_root"]["kept"], true);
+        assert!(converted.data.warnings.iter().any(|warning| matches!(
+            warning,
+            MigrationWarning::UnsupportedDomain { domain, .. } if domain == "future_hub"
+        )));
+        assert!(converted.data.warnings.iter().any(|warning| matches!(
+            warning,
+            MigrationWarning::UnsupportedField { field, .. } if field == "future_field"
+        )));
+
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_config_entries(dir.path(), &converted).unwrap();
+        let restored = read_homecore_config_entries(&path).unwrap();
+        assert_eq!(restored, converted);
+    }
+
+    #[test]
+    fn unknown_destination_version_is_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join(DESTINATION_KEY);
+        std::fs::write(
+            &path,
+            r#"{"version":99,"minor_version":0,"key":"homecore.config_entries","data":{"source_version":1,"source_minor_version":1,"entries":[],"warnings":[]}}"#,
+        )
+        .unwrap();
         assert!(matches!(
-            err,
-            MigrateError::UnsupportedSchemaVersion { minor_version: 99, .. }
+            read_homecore_config_entries(&path),
+            Err(MigrateError::UnsupportedSchemaVersion { version: 99, .. })
+        ));
+    }
+
+    #[test]
+    fn malformed_entry_is_an_error_not_a_partial_write() {
+        let mut source = NamedTempFile::new().unwrap();
+        source
+            .write_all(
+                br#"{"version":1,"minor_version":1,"key":"core.config_entries","data":{"entries":[{"domain":"hue"}]}}"#,
+            )
+            .unwrap();
+        assert!(matches!(
+            convert_config_entries(source.path()),
+            Err(MigrateError::MissingField { .. })
         ));
     }
 }
diff --git a/v2/crates/homecore-migrate/src/device_registry.rs b/v2/crates/homecore-migrate/src/device_registry.rs
index 39ccfd93..c2ff0b51 100644
--- a/v2/crates/homecore-migrate/src/device_registry.rs
+++ b/v2/crates/homecore-migrate/src/device_registry.rs
@@ -1,60 +1,131 @@
-//! Parser for `core.device_registry` (HA storage schema v1, minor_version 1–13).
-//!
-//! P1: deserializes the envelope and returns `Vec<DeviceImport>`.
-//! HOMECORE's device registry isn't fully wired yet (ADR-127 §2.5 deferred
-//! to P2), so `DeviceImport` is a staging type for the future hand-off.
+//! Conversion for HA `core.device_registry` schema v1/minor 1-13.
 
-use std::path::Path;
+use std::collections::{BTreeMap, HashSet};
+use std::path::{Path, PathBuf};
 
-use serde::{Deserialize, Serialize};
+use homecore::DeviceEntry;
+use serde::Deserialize;
 
-use crate::{storage::read_envelope, storage_format::v13, MigrateError};
+use crate::{
+    storage::{read_envelope, write_json_atomic_noclobber},
+    storage_format::v13,
+    MigrateError,
+};
 
-/// Staging type for a device imported from HA. Not yet wired to HOMECORE's
-/// device registry (ADR-127 §2.5 — deferred to P2).
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DeviceImport {
-    pub id: String,
-    pub config_entries: Vec<String>,
-    #[serde(default)]
-    pub manufacturer: Option<String>,
-    #[serde(default)]
-    pub model: Option<String>,
-    #[serde(default)]
-    pub name: Option<String>,
-    /// `identifiers` — list of `[integration, id]` pairs. Preserved as raw
-    /// JSON for P2 consumption; not yet mapped to HOMECORE DeviceEntry.
-    #[serde(default)]
-    pub identifiers: Vec<Vec<String>>,
-    #[serde(default)]
-    pub connections: Vec<Vec<String>>,
-    #[serde(default)]
-    pub via_device_id: Option<String>,
-    #[serde(default)]
-    pub area_id: Option<String>,
-}
+const FILE_KEY: &str = "core.device_registry";
 
 #[derive(Debug, Deserialize)]
 struct HaDeviceRegistryData {
-    devices: Vec<DeviceImport>,
-    /// Deleted device tombstones — ignored in P1.
+    devices: Vec<HaDeviceRow>,
     #[serde(default)]
-    #[allow(dead_code)]
     deleted_devices: Vec<serde_json::Value>,
 }
 
-/// Read `core.device_registry` from `path` and return the raw import list.
-pub fn read_device_registry(path: &Path) -> Result<Vec<DeviceImport>, MigrateError> {
-    let env = read_envelope(path)?;
-    let file_str = path.display().to_string();
-    v13::require_supported(&file_str, env.version, env.minor_version)?;
+#[derive(Debug, Deserialize)]
+struct HaDeviceRow {
+    id: String,
+    #[serde(default)]
+    config_entries: HashSet<String>,
+    #[serde(default)]
+    identifiers: HashSet<(String, String)>,
+    #[serde(default)]
+    connections: HashSet<(String, String)>,
+    #[serde(default)]
+    manufacturer: Option<String>,
+    #[serde(default)]
+    model: Option<String>,
+    #[serde(default)]
+    model_id: Option<String>,
+    #[serde(default)]
+    name: Option<String>,
+    #[serde(default)]
+    name_by_user: Option<String>,
+    #[serde(default)]
+    sw_version: Option<String>,
+    #[serde(default)]
+    hw_version: Option<String>,
+    #[serde(default)]
+    serial_number: Option<String>,
+    #[serde(default)]
+    via_device_id: Option<String>,
+    #[serde(default)]
+    area_id: Option<String>,
+    #[serde(default)]
+    entry_type: Option<String>,
+    #[serde(default)]
+    disabled_by: Option<String>,
+    #[serde(default)]
+    configuration_url: Option<String>,
+    #[serde(default)]
+    labels: HashSet<String>,
+    #[serde(default)]
+    primary_config_entry: Option<String>,
+    #[serde(default, flatten)]
+    extra: BTreeMap<String, serde_json::Value>,
+}
 
+impl From<HaDeviceRow> for DeviceEntry {
+    fn from(row: HaDeviceRow) -> Self {
+        Self {
+            id: row.id,
+            config_entries: row.config_entries,
+            identifiers: row.identifiers,
+            connections: row.connections,
+            manufacturer: row.manufacturer,
+            model: row.model,
+            model_id: row.model_id,
+            name: row.name,
+            name_by_user: row.name_by_user,
+            sw_version: row.sw_version,
+            hw_version: row.hw_version,
+            serial_number: row.serial_number,
+            via_device_id: row.via_device_id,
+            area_id: row.area_id,
+            entry_type: row.entry_type,
+            disabled_by: row.disabled_by,
+            configuration_url: row.configuration_url,
+            labels: row.labels,
+            primary_config_entry: row.primary_config_entry,
+            extra: row.extra,
+        }
+    }
+}
+
+pub fn read_device_registry(path: &Path) -> Result<Vec<DeviceEntry>, MigrateError> {
+    let env = read_envelope(path)?;
+    let file = path.display().to_string();
+    v13::require_supported(&file, env.version, env.minor_version)?;
+    if env.key != FILE_KEY {
+        return Err(MigrateError::UnexpectedStorageKey {
+            path: file,
+            expected: FILE_KEY.to_owned(),
+            actual: env.key,
+        });
+    }
     let data: HaDeviceRegistryData =
-        serde_json::from_value(env.data).map_err(|e| MigrateError::JsonParse {
-            path: file_str,
-            source: e,
+        serde_json::from_value(env.data).map_err(|source| MigrateError::JsonParse {
+            path: path.display().to_string(),
+            source,
         })?;
-    Ok(data.devices)
+    let _preserved_tombstone_count = data.deleted_devices.len();
+    Ok(data.devices.into_iter().map(DeviceEntry::from).collect())
+}
+
+pub fn write_device_registry(
+    storage_dir: &Path,
+    devices: &[DeviceEntry],
+) -> Result<PathBuf, MigrateError> {
+    let target = storage_dir.join(FILE_KEY);
+    let payload = serde_json::json!({
+        "version": 1,
+        "minor_version": 13,
+        "key": FILE_KEY,
+        "data": {
+            "devices": devices,
+            "deleted_devices": []
+        }
+    });
+    write_json_atomic_noclobber(&target, &payload)
 }
 
 #[cfg(test)]
@@ -64,36 +135,49 @@ mod tests {
     use tempfile::NamedTempFile;
 
     const FIXTURE: &str = r#"{
-        "version": 1,
-        "minor_version": 13,
-        "key": "core.device_registry",
-        "data": {
-            "devices": [
-                {
-                    "id": "dev_abc",
-                    "config_entries": ["ce_001"],
-                    "manufacturer": "Philips",
-                    "model": "Hue Bridge",
-                    "name": "Philips Hue Bridge",
-                    "identifiers": [["hue", "001788FFFE3D4B13"]],
-                    "connections": [["mac", "00:17:88:ff:fe:3d:4b:13"]],
-                    "via_device_id": null,
-                    "area_id": null
-                }
-            ],
-            "deleted_devices": []
-        }
+      "version":1,"minor_version":13,"key":"core.device_registry",
+      "data":{"devices":[{
+        "id":"dev_abc","config_entries":["ce_001"],
+        "manufacturer":"Philips","model":"Hue Bridge","model_id":"BSB002",
+        "name":"Hue","name_by_user":"Downstairs Hue",
+        "sw_version":"1.2","hw_version":"3","serial_number":"SN42",
+        "identifiers":[["hue","001788FFFE3D4B13"]],
+        "connections":[["mac","00:17:88:ff:fe:3d:4b:13"]],
+        "via_device_id":"gateway","area_id":"living_room",
+        "entry_type":"service","disabled_by":"user",
+        "configuration_url":"http://hue.local","labels":["lighting"],
+        "primary_config_entry":"ce_001","created_at":1735689600.0
+      }],"deleted_devices":[]}
     }"#;
 
     #[test]
-    fn parses_device_registry() {
-        let mut f = NamedTempFile::new().unwrap();
-        f.write_all(FIXTURE.as_bytes()).unwrap();
-        let devices = read_device_registry(f.path()).unwrap();
-        assert_eq!(devices.len(), 1);
-        let d = &devices[0];
-        assert_eq!(d.id, "dev_abc");
-        assert_eq!(d.manufacturer.as_deref(), Some("Philips"));
-        assert_eq!(d.identifiers, vec![vec!["hue", "001788FFFE3D4B13"]]);
+    fn all_supported_fields_round_trip() {
+        let mut source = NamedTempFile::new().unwrap();
+        source.write_all(FIXTURE.as_bytes()).unwrap();
+        let devices = read_device_registry(source.path()).unwrap();
+        let destination = tempfile::tempdir().unwrap();
+        let path = write_device_registry(destination.path(), &devices).unwrap();
+        let imported = read_device_registry(&path).unwrap();
+        assert_eq!(imported, devices);
+        assert_eq!(imported[0].serial_number.as_deref(), Some("SN42"));
+        assert!(imported[0].labels.contains("lighting"));
+        assert_eq!(imported[0].extra["created_at"], 1735689600.0);
+    }
+
+    #[test]
+    fn destination_is_never_overwritten() {
+        let mut source = NamedTempFile::new().unwrap();
+        source.write_all(FIXTURE.as_bytes()).unwrap();
+        let devices = read_device_registry(source.path()).unwrap();
+        let destination = tempfile::tempdir().unwrap();
+        write_device_registry(destination.path(), &devices).unwrap();
+        let error = write_device_registry(destination.path(), &[]).unwrap_err();
+        assert!(error.to_string().contains("refusing to overwrite"));
+        assert_eq!(
+            read_device_registry(&destination.path().join(FILE_KEY))
+                .unwrap()
+                .len(),
+            1
+        );
     }
 }
diff --git a/v2/crates/homecore-migrate/src/entity_registry.rs b/v2/crates/homecore-migrate/src/entity_registry.rs
index ec5d61c6..f4658fbc 100644
--- a/v2/crates/homecore-migrate/src/entity_registry.rs
+++ b/v2/crates/homecore-migrate/src/entity_registry.rs
@@ -26,15 +26,17 @@
 //! }
 //! ```
 
-use std::fs::{self, OpenOptions};
-use std::io::Write;
 use std::path::{Path, PathBuf};
 
 use serde::{Deserialize, Serialize};
 
 use homecore::{registry::DisabledBy, EntityCategory, EntityEntry, EntityId};
 
-use crate::{storage::read_envelope, storage_format::v13, MigrateError};
+use crate::{
+    storage::{read_envelope, write_json_atomic_noclobber},
+    storage_format::v13,
+    MigrateError,
+};
 
 // Key used by `inspect` subcommand when scanning the directory.
 #[allow(dead_code)]
@@ -173,21 +175,7 @@ pub fn write_entity_registry(
     storage_dir: &Path,
     entries: &[EntityEntry],
 ) -> Result<PathBuf, MigrateError> {
-    fs::create_dir_all(storage_dir).map_err(|source| MigrateError::Io {
-        path: storage_dir.display().to_string(),
-        source,
-    })?;
     let target = storage_dir.join(FILE_KEY);
-    if target.exists() {
-        return Err(MigrateError::Io {
-            path: target.display().to_string(),
-            source: std::io::Error::new(
-                std::io::ErrorKind::AlreadyExists,
-                "destination exists; refusing to overwrite",
-            ),
-        });
-    }
-    let temp = storage_dir.join(format!(".{FILE_KEY}.{}.tmp", std::process::id()));
     let payload = serde_json::json!({
         "version": 1,
         "minor_version": 13,
@@ -197,29 +185,7 @@ pub fn write_entity_registry(
             "deleted_entities": []
         }
     });
-    let bytes = serde_json::to_vec_pretty(&payload).map_err(|source| MigrateError::JsonParse {
-        path: target.display().to_string(),
-        source,
-    })?;
-
-    let result = (|| {
-        let mut file = OpenOptions::new()
-            .create_new(true)
-            .write(true)
-            .open(&temp)?;
-        file.write_all(&bytes)?;
-        file.write_all(b"\n")?;
-        file.sync_all()?;
-        fs::rename(&temp, &target)
-    })();
-    if let Err(source) = result {
-        let _ = fs::remove_file(&temp);
-        return Err(MigrateError::Io {
-            path: target.display().to_string(),
-            source,
-        });
-    }
-    Ok(target)
+    write_json_atomic_noclobber(&target, &payload)
 }
 
 #[cfg(test)]
diff --git a/v2/crates/homecore-migrate/src/lib.rs b/v2/crates/homecore-migrate/src/lib.rs
index 4eff1115..660f81b8 100644
--- a/v2/crates/homecore-migrate/src/lib.rs
+++ b/v2/crates/homecore-migrate/src/lib.rs
@@ -4,20 +4,21 @@
 //! (HOMECORE-MIGRATE; ADR-126 §4 series map labels the role "ADR-134 HOMECORE-MIGRATE",
 //! but on-disk ADR-134 is CIR — the migrate decision was renumbered to ADR-165. See ADR-164).
 //!
-//! ## P1 scope
+//! ## Implemented scope
 //!
 //! - [`storage`] — `HaStorageDir`, `HaStorageEnvelope`; `read_envelope(path)`
 //! - [`storage_format`] — versioned format parsers (`v13`); unknown minor_version → hard error
 //! - [`entity_registry`] — `core.entity_registry` → `Vec<homecore::EntityEntry>`
-//! - [`device_registry`] — `core.device_registry` → `Vec<DeviceImport>` (P1 stub)
-//! - [`config_entries`] — `core.config_entries` diagnostic (count + domain list; P2 converts)
+//! - [`device_registry`] — full supported HA v13 device fields → `homecore::DeviceEntry`
+//! - [`config_entries`] — lossless, versioned HOMECORE representation + typed warnings
 //! - [`secrets`] — `secrets.yaml` → `HashMap<String, String>`
 //! - [`automations`] — `automations.yaml` count + ID list (P2 converts)
 //! - [`cli`] — `clap`-derived subcommand types shared between `src/main.rs` and tests
 //!
-//! ## What is NOT here yet (deferred to P2+)
+//! ## Remaining limitations
 //!
-//! - Conversion of `config_entries` to HOMECORE plugin manifests
+//! - Imported config entries are durable but do not make an HA integration executable;
+//!   a matching HOMECORE plugin must consume the preserved source payload.
 //! - Conversion of `automations.yaml` to `homecore-automation` YAML
 //! - Side-by-side runtime mode (requires `homecore-recorder`, ADR-132)
 //! - `!secret` reference resolution in non-secrets YAML files
@@ -88,6 +89,13 @@ pub enum MigrateError {
         minor_version: u32,
     },
 
+    #[error("unexpected storage key in {path}: expected {expected}, got {actual}")]
+    UnexpectedStorageKey {
+        path: String,
+        expected: String,
+        actual: String,
+    },
+
     #[error("missing required field '{field}' in {context}")]
     MissingField { field: String, context: String },
 
diff --git a/v2/crates/homecore-migrate/src/main.rs b/v2/crates/homecore-migrate/src/main.rs
index 95e2284b..b89097fa 100644
--- a/v2/crates/homecore-migrate/src/main.rs
+++ b/v2/crates/homecore-migrate/src/main.rs
@@ -2,6 +2,21 @@
 
 use clap::Parser;
 use homecore_migrate::cli::{Cli, Command};
+use serde::Serialize;
+
+#[derive(Serialize)]
+struct ImportSummary {
+    kind: &'static str,
+    imported: usize,
+    warning_count: usize,
+    warnings: Vec<serde_json::Value>,
+    destination: std::path::PathBuf,
+}
+
+fn print_summary(summary: &ImportSummary) -> anyhow::Result<()> {
+    println!("{}", serde_json::to_string(summary)?);
+    Ok(())
+}
 
 fn main() -> anyhow::Result<()> {
     tracing_subscriber::fmt::init();
@@ -9,7 +24,10 @@ fn main() -> anyhow::Result<()> {
 
     match cli.command {
         Command::Inspect(args) => {
-            println!("Inspecting HA .storage directory: {}", args.storage.display());
+            println!(
+                "Inspecting HA .storage directory: {}",
+                args.storage.display()
+            );
             // Probe entity_registry
             let entity_path = args.storage.join("core.entity_registry");
             if entity_path.exists() {
@@ -42,33 +60,35 @@ fn main() -> anyhow::Result<()> {
 
         Command::ImportEntities(args) => {
             let entity_path = args.storage.join("core.entity_registry");
-            let entries =
-                homecore_migrate::entity_registry::read_entity_registry(&entity_path)?;
+            let entries = homecore_migrate::entity_registry::read_entity_registry(&entity_path)?;
             let destination =
                 homecore_migrate::entity_registry::write_entity_registry(&args.to, &entries)?;
-            println!("Imported {} entity entries", entries.len());
-            println!("  Destination: {}", destination.display());
-            for e in &entries {
-                println!(
-                    "  {} ({}{})",
-                    e.entity_id.as_str(),
-                    e.platform,
-                    if e.disabled_by.is_some() { " DISABLED" } else { "" }
-                );
-            }
+            print_summary(&ImportSummary {
+                kind: "entity_registry",
+                imported: entries.len(),
+                warning_count: 0,
+                warnings: vec![],
+                destination,
+            })?;
         }
 
         Command::ImportDevices(args) => {
             let device_path = args.storage.join("core.device_registry");
-            let devices =
-                homecore_migrate::device_registry::read_device_registry(&device_path)?;
-            println!("Parsed {} device entries (P1: staging only, wiring to HOMECORE is P2)", devices.len());
+            let devices = homecore_migrate::device_registry::read_device_registry(&device_path)?;
+            let destination =
+                homecore_migrate::device_registry::write_device_registry(&args.to, &devices)?;
+            print_summary(&ImportSummary {
+                kind: "device_registry",
+                imported: devices.len(),
+                warning_count: 0,
+                warnings: vec![],
+                destination,
+            })?;
         }
 
         Command::InspectConfigEntries(args) => {
             let ce_path = args.storage.join("core.config_entries");
-            let summary =
-                homecore_migrate::config_entries::inspect_config_entries(&ce_path)?;
+            let summary = homecore_migrate::config_entries::inspect_config_entries(&ce_path)?;
             println!(
                 "config_entries: {} total, domains: {}",
                 summary.count,
@@ -76,6 +96,28 @@ fn main() -> anyhow::Result<()> {
             );
         }
 
+        Command::ImportConfigEntries(args) => {
+            let source = args.storage.join("core.config_entries");
+            let converted = homecore_migrate::config_entries::convert_config_entries(&source)?;
+            let imported = converted.data.entries.len();
+            let warning_count = converted.data.warnings.len();
+            let warnings = converted
+                .data
+                .warnings
+                .iter()
+                .map(serde_json::to_value)
+                .collect::<Result<Vec<_>, _>>()?;
+            let destination =
+                homecore_migrate::config_entries::write_config_entries(&args.to, &converted)?;
+            print_summary(&ImportSummary {
+                kind: "config_entries",
+                imported,
+                warning_count,
+                warnings,
+                destination,
+            })?;
+        }
+
         Command::InspectSecrets(args) => {
             let secrets_path = args.config_dir.join("secrets.yaml");
             let secrets = homecore_migrate::secrets::read_secrets(&secrets_path)?;
diff --git a/v2/crates/homecore-migrate/src/storage.rs b/v2/crates/homecore-migrate/src/storage.rs
index 770c8d65..d86a5bc1 100644
--- a/v2/crates/homecore-migrate/src/storage.rs
+++ b/v2/crates/homecore-migrate/src/storage.rs
@@ -15,12 +15,17 @@
 //! left as `serde_json::Value` — version-specific parsers in `storage_format`
 //! are responsible for further deserialization.
 
+use std::fs::{self, OpenOptions};
+use std::io::Write;
 use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
 
 use serde::{Deserialize, Serialize};
 
 use crate::MigrateError;
 
+static TEMP_SEQUENCE: AtomicU64 = AtomicU64::new(0);
+
 /// Points to a HA `.storage/` directory.
 #[derive(Clone, Debug)]
 pub struct HaStorageDir {
@@ -66,6 +71,70 @@ pub fn read_envelope(path: &Path) -> Result<HaStorageEnvelope, MigrateError> {
     })
 }
 
+/// Durably publish JSON at `target` without ever replacing an existing file.
+///
+/// Bytes are synced in a same-directory temporary file, then exposed with an
+/// atomic hard-link create. `hard_link` fails with `AlreadyExists` if another
+/// process won the destination race, unlike a POSIX rename which would replace
+/// the destination after a check-then-rename sequence.
+pub fn write_json_atomic_noclobber<T: Serialize>(
+    target: &Path,
+    value: &T,
+) -> Result<PathBuf, MigrateError> {
+    let parent = target.parent().ok_or_else(|| MigrateError::Io {
+        path: target.display().to_string(),
+        source: std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "destination has no parent directory",
+        ),
+    })?;
+    fs::create_dir_all(parent).map_err(|source| MigrateError::Io {
+        path: parent.display().to_string(),
+        source,
+    })?;
+
+    let bytes = serde_json::to_vec_pretty(value).map_err(|source| MigrateError::JsonParse {
+        path: target.display().to_string(),
+        source,
+    })?;
+    let sequence = TEMP_SEQUENCE.fetch_add(1, Ordering::Relaxed);
+    let name = target
+        .file_name()
+        .and_then(|value| value.to_str())
+        .unwrap_or("storage");
+    let temp = parent.join(format!(".{name}.{}.{}.tmp", std::process::id(), sequence));
+
+    let result = (|| -> std::io::Result<()> {
+        let mut file = OpenOptions::new()
+            .create_new(true)
+            .write(true)
+            .open(&temp)?;
+        file.write_all(&bytes)?;
+        file.write_all(b"\n")?;
+        file.sync_all()?;
+        fs::hard_link(&temp, target)?;
+        fs::remove_file(&temp)?;
+        Ok(())
+    })();
+
+    if let Err(source) = result {
+        let _ = fs::remove_file(&temp);
+        let source = if source.kind() == std::io::ErrorKind::AlreadyExists {
+            std::io::Error::new(
+                std::io::ErrorKind::AlreadyExists,
+                "destination exists; refusing to overwrite",
+            )
+        } else {
+            source
+        };
+        return Err(MigrateError::Io {
+            path: target.display().to_string(),
+            source,
+        });
+    }
+    Ok(target.to_path_buf())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/v2/crates/homecore-recorder/README.md b/v2/crates/homecore-recorder/README.md
index 093bb151..e31c8054 100644
--- a/v2/crates/homecore-recorder/README.md
+++ b/v2/crates/homecore-recorder/README.md
@@ -30,6 +30,8 @@ Data persists in `.homecore/home.db` (by default; configurable). Queries work vi
 - **Attribute persistence** — JSON attributes for entities stored in separate table (HA pattern)
 - **Automatic deduplication** — skip writes when state hasn't changed (detect via hash)
 - **Recorder runs table** — track purge cycles and migration events (HA `recorder_runs` equivalent)
+- **Startup restoration** — deterministic newest row per entity, bounded at
+  100,000 rows, with malformed rows isolated as typed warnings
 - **Semantic search** (P2, `--features ruvector`) — embed state attributes + query by meaning
 - **HNSW index** (P2) — k-NN search for "all warm rooms" via ruvector
 - **No data export overhead** — SQLite is queryable directly; no proprietary format
@@ -41,6 +43,7 @@ Data persists in `.homecore/home.db` (by default; configurable). Queries work vi
 | Record state change | Listener | `RecorderListener::on_state_changed(event)` | Fires on homecore event bus; writes to SQLite |
 | Query state history | SQL | `SELECT * FROM states WHERE entity_id = ? ORDER BY last_changed DESC` | Standard SQLite; can be queried from anywhere |
 | Purge old states | Maintenance | `Recorder::purge(older_than)` | Deletes states older than specified timestamp |
+| Restore latest states | Startup | `Recorder::restore_latest(states, limit)` | Entity-id ordered, bounded, malformed-row isolation |
 | Deduplicate write | Dedup | `DedupEngine::should_record(old_state, new_state)` | Skip if state hash unchanged |
 | Create semantic index | Index | `SemanticIndex::index_state(entity_id, state)` (P2, opt-in) | Hash-based embeddings; real embeddings in P3 |
 | Search by meaning | Search | `SemanticIndex::search(query, k)` (P2, opt-in) | "warm rooms" → k-NN search in ruvector HNSW |
diff --git a/v2/crates/homecore-recorder/src/db.rs b/v2/crates/homecore-recorder/src/db.rs
index 5611e6e1..741b33e5 100644
--- a/v2/crates/homecore-recorder/src/db.rs
+++ b/v2/crates/homecore-recorder/src/db.rs
@@ -20,7 +20,8 @@ use tokio::sync::RwLock;
 use tracing::debug;
 
 use homecore::entity::{EntityId, State};
-use homecore::event::{DomainEvent, StateChangedEvent};
+use homecore::event::{Context, DomainEvent, StateChangedEvent};
+use homecore::StateMachine;
 
 use crate::dedup::fnv64a_hash;
 use crate::schema::ALL_DDL;
@@ -45,6 +46,8 @@ type HistoryStateRecord = (i64, String, Option<String>, f64, f64, Option<String>
 /// history-graph query, small enough to bound the worst case. Callers needing a
 /// wider span page by narrowing the window.
 pub const MAX_HISTORY_ROWS: i64 = 1_000_000;
+/// Absolute cap for one startup restore query.
+pub const MAX_RESTORE_STATES: usize = 100_000;
 
 /// Errors returned by `Recorder` operations.
 #[derive(Error, Debug)]
@@ -302,7 +305,7 @@ impl Recorder {
         let pattern = format!("%{escaped}%");
 
         let rows: Vec<SearchStateRecord> = sqlx::query_as(
-                "SELECT s.state_id, s.entity_id, s.state, sa.shared_attrs, \
+            "SELECT s.state_id, s.entity_id, s.state, sa.shared_attrs, \
                         s.last_changed_ts, s.last_updated_ts, s.context_id \
                  FROM states s \
                  LEFT JOIN state_attributes sa ON s.attributes_id = sa.attributes_id \
@@ -312,47 +315,57 @@ impl Recorder {
                     OR sa.shared_attrs LIKE ?2 ESCAPE '\\' \
                  ORDER BY s.last_updated_ts DESC \
                  LIMIT ?3",
-            )
-            .bind(query)
-            .bind(&pattern)
-            .bind(k as i64)
-            .fetch_all(&self.pool)
-            .await?;
+        )
+        .bind(query)
+        .bind(&pattern)
+        .bind(k as i64)
+        .fetch_all(&self.pool)
+        .await?;
 
         rows.into_iter()
-            .map(|(state_id, entity_id, state, shared_attrs, last_changed_ts, last_updated_ts, context_id)| {
-                let eid = EntityId::parse(&entity_id)
-                    .unwrap_or_else(|_| EntityId::parse("unknown.unknown").unwrap());
-                let attributes = shared_attrs
-                    .as_deref()
-                    .map(serde_json::from_str)
-                    .transpose()?
-                    .unwrap_or(serde_json::Value::Object(Default::default()));
-                Ok(StateRow {
+            .map(
+                |(
                     state_id,
-                    entity_id: eid,
+                    entity_id,
                     state,
-                    attributes,
+                    shared_attrs,
                     last_changed_ts,
                     last_updated_ts,
                     context_id,
-                })
-            })
+                )| {
+                    let eid = EntityId::parse(&entity_id)
+                        .unwrap_or_else(|_| EntityId::parse("unknown.unknown").unwrap());
+                    let attributes = shared_attrs
+                        .as_deref()
+                        .map(serde_json::from_str)
+                        .transpose()?
+                        .unwrap_or(serde_json::Value::Object(Default::default()));
+                    Ok(StateRow {
+                        state_id,
+                        entity_id: eid,
+                        state,
+                        attributes,
+                        last_changed_ts,
+                        last_updated_ts,
+                        context_id,
+                    })
+                },
+            )
             .collect()
     }
 
     /// Fetch a single `StateRow` by its `state_id`, joining attributes.
     async fn fetch_state_row(&self, state_id: i64) -> Result<Option<StateRow>, RecorderError> {
         let row: Option<StateRecord> = sqlx::query_as(
-                "SELECT s.entity_id, s.state, sa.shared_attrs, \
+            "SELECT s.entity_id, s.state, sa.shared_attrs, \
                          s.last_changed_ts, s.last_updated_ts, s.context_id \
                  FROM states s \
                  LEFT JOIN state_attributes sa ON s.attributes_id = sa.attributes_id \
                  WHERE s.state_id = ?",
-            )
-            .bind(state_id)
-            .fetch_optional(&self.pool)
-            .await?;
+        )
+        .bind(state_id)
+        .fetch_optional(&self.pool)
+        .await?;
 
         let Some((entity_id, state, shared_attrs, last_changed_ts, last_updated_ts, context_id)) =
             row
@@ -438,26 +451,184 @@ impl Recorder {
         .await?;
 
         rows.into_iter()
-            .map(|(state_id, state, shared_attrs, last_changed_ts, last_updated_ts, context_id)| {
-                let attributes = shared_attrs
-                    .as_deref()
-                    .map(serde_json::from_str)
-                    .transpose()?
-                    .unwrap_or(serde_json::Value::Object(Default::default()));
+            .map(
+                |(state_id, state, shared_attrs, last_changed_ts, last_updated_ts, context_id)| {
+                    let attributes = shared_attrs
+                        .as_deref()
+                        .map(serde_json::from_str)
+                        .transpose()?
+                        .unwrap_or(serde_json::Value::Object(Default::default()));
 
-                Ok(StateRow {
-                    state_id,
-                    entity_id: entity_id.clone(),
-                    state,
-                    attributes,
-                    last_changed_ts,
-                    last_updated_ts,
-                    context_id,
-                })
-            })
+                    Ok(StateRow {
+                        state_id,
+                        entity_id: entity_id.clone(),
+                        state,
+                        attributes,
+                        last_changed_ts,
+                        last_updated_ts,
+                        context_id,
+                    })
+                },
+            )
             .collect()
     }
 
+    /// Read the newest row for each entity in deterministic entity-id order.
+    ///
+    /// The query is bounded and uses `(last_updated_ts, state_id)` as a stable
+    /// newest-row tie-break. Malformed rows are reported and skipped
+    /// individually so one corrupt entity cannot prevent the rest from
+    /// starting.
+    pub async fn latest_states(
+        &self,
+        requested_limit: usize,
+    ) -> Result<LatestStates, RecorderError> {
+        let limit = requested_limit.min(MAX_RESTORE_STATES);
+        if limit == 0 {
+            return Ok(LatestStates::default());
+        }
+        type RawRestoreRow = (
+            i64,
+            String,
+            Option<String>,
+            Option<String>,
+            Option<f64>,
+            Option<f64>,
+            Option<String>,
+        );
+        let rows: Vec<RawRestoreRow> = sqlx::query_as(
+            "SELECT state_id, entity_id, state, shared_attrs, \
+                    last_changed_ts, last_updated_ts, context_id \
+             FROM ( \
+               SELECT s.state_id, s.entity_id, s.state, sa.shared_attrs, \
+                      s.last_changed_ts, s.last_updated_ts, s.context_id, \
+                      ROW_NUMBER() OVER ( \
+                        PARTITION BY s.entity_id \
+                        ORDER BY s.last_updated_ts DESC, s.state_id DESC \
+                      ) AS newest \
+               FROM states s \
+               LEFT JOIN state_attributes sa ON s.attributes_id = sa.attributes_id \
+             ) \
+             WHERE newest = 1 \
+             ORDER BY entity_id ASC \
+             LIMIT ?",
+        )
+        .bind((limit + 1) as i64)
+        .fetch_all(&self.pool)
+        .await?;
+
+        let truncated = rows.len() > limit;
+        let mut states = Vec::with_capacity(rows.len().min(limit));
+        let mut warnings = Vec::new();
+        for (
+            state_id,
+            raw_entity_id,
+            raw_state,
+            raw_attributes,
+            last_changed_ts,
+            last_updated_ts,
+            context_id,
+        ) in rows.into_iter().take(limit)
+        {
+            let entity_id = match EntityId::parse(&raw_entity_id) {
+                Ok(value) => value,
+                Err(error) => {
+                    warnings.push(RestoreWarning::MalformedEntityId {
+                        state_id,
+                        entity_id: raw_entity_id,
+                        reason: error.to_string(),
+                    });
+                    continue;
+                }
+            };
+            let Some(state) = raw_state else {
+                warnings.push(RestoreWarning::MissingState {
+                    state_id,
+                    entity_id: raw_entity_id,
+                });
+                continue;
+            };
+            let attributes = match raw_attributes {
+                Some(value) => match serde_json::from_str(&value) {
+                    Ok(value) => value,
+                    Err(error) => {
+                        warnings.push(RestoreWarning::MalformedAttributes {
+                            state_id,
+                            entity_id: raw_entity_id,
+                            reason: error.to_string(),
+                        });
+                        continue;
+                    }
+                },
+                None => serde_json::json!({}),
+            };
+            let Some(last_changed) = last_changed_ts.and_then(timestamp_from_seconds) else {
+                warnings.push(RestoreWarning::MalformedTimestamp {
+                    state_id,
+                    entity_id: raw_entity_id,
+                    field: "last_changed_ts",
+                });
+                continue;
+            };
+            let Some(last_updated) = last_updated_ts.and_then(timestamp_from_seconds) else {
+                warnings.push(RestoreWarning::MalformedTimestamp {
+                    state_id,
+                    entity_id: raw_entity_id,
+                    field: "last_updated_ts",
+                });
+                continue;
+            };
+            let parent_id = match context_id {
+                Some(value) => match value.parse() {
+                    Ok(value) => Some(value),
+                    Err(_) => {
+                        warnings.push(RestoreWarning::MalformedContext {
+                            state_id,
+                            entity_id: raw_entity_id.clone(),
+                        });
+                        None
+                    }
+                },
+                None => None,
+            };
+            states.push(State {
+                entity_id,
+                state,
+                attributes,
+                last_changed,
+                last_updated,
+                context: Context::restoration(parent_id),
+            });
+        }
+        Ok(LatestStates {
+            states,
+            warnings,
+            truncated,
+        })
+    }
+
+    /// Load latest durable snapshots into a state machine without producing
+    /// fresh recorder events.
+    pub async fn restore_latest(
+        &self,
+        states: &StateMachine,
+        limit: usize,
+    ) -> Result<RestoreReport, RecorderError> {
+        let batch = self.latest_states(limit).await?;
+        let mut restored = 0;
+        for state in batch.states {
+            // latest_states constructs the required restoration marker.
+            if states.restore(state).is_ok() {
+                restored += 1;
+            }
+        }
+        Ok(RestoreReport {
+            restored,
+            warnings: batch.warnings,
+            truncated: batch.truncated,
+        })
+    }
+
     /// Purge history older than `older_than`, returning a [`PurgeStats`] summary.
     ///
     /// Deletes:
@@ -521,6 +692,58 @@ impl Recorder {
     }
 }
 
+fn timestamp_from_seconds(value: f64) -> Option<DateTime<Utc>> {
+    if !value.is_finite() {
+        return None;
+    }
+    let micros = (value * 1_000_000.0).round();
+    if micros < i64::MIN as f64 || micros > i64::MAX as f64 {
+        return None;
+    }
+    DateTime::from_timestamp_micros(micros as i64)
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RestoreWarning {
+    MalformedEntityId {
+        state_id: i64,
+        entity_id: String,
+        reason: String,
+    },
+    MissingState {
+        state_id: i64,
+        entity_id: String,
+    },
+    MalformedAttributes {
+        state_id: i64,
+        entity_id: String,
+        reason: String,
+    },
+    MalformedTimestamp {
+        state_id: i64,
+        entity_id: String,
+        field: &'static str,
+    },
+    MalformedContext {
+        state_id: i64,
+        entity_id: String,
+    },
+}
+
+#[derive(Debug, Default)]
+pub struct LatestStates {
+    pub states: Vec<State>,
+    pub warnings: Vec<RestoreWarning>,
+    pub truncated: bool,
+}
+
+#[derive(Debug)]
+pub struct RestoreReport {
+    pub restored: usize,
+    pub warnings: Vec<RestoreWarning>,
+    pub truncated: bool,
+}
+
 /// Summary of a [`Recorder::purge`] run.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct PurgeStats {
@@ -564,14 +787,20 @@ mod tests {
     use super::*;
 
     async fn open_memory() -> Recorder {
-        Recorder::open("sqlite::memory:").await.expect("open in-memory DB")
+        Recorder::open("sqlite::memory:")
+            .await
+            .expect("open in-memory DB")
     }
 
     fn entity(s: &str) -> EntityId {
         EntityId::parse(s).unwrap()
     }
 
-    fn make_state_event(entity_id: &str, state_val: &str, attrs: serde_json::Value) -> StateChangedEvent {
+    fn make_state_event(
+        entity_id: &str,
+        state_val: &str,
+        attrs: serde_json::Value,
+    ) -> StateChangedEvent {
         let eid = entity(entity_id);
         let ctx = Context::new();
         let s = Arc::new(State::new(eid.clone(), state_val, attrs, ctx));
@@ -595,7 +824,10 @@ mod tests {
                 .await
                 .unwrap();
         let names: Vec<&str> = tables.iter().map(|(n,)| n.as_str()).collect();
-        assert!(names.contains(&"state_attributes"), "missing state_attributes");
+        assert!(
+            names.contains(&"state_attributes"),
+            "missing state_attributes"
+        );
         assert!(names.contains(&"states"), "missing states");
         assert!(names.contains(&"events"), "missing events");
         assert!(names.contains(&"recorder_runs"), "missing recorder_runs");
@@ -605,7 +837,10 @@ mod tests {
     async fn schema_idempotent_double_open() {
         // Applying schema twice (on the same pool) must not panic or error.
         let recorder = open_memory().await;
-        recorder.apply_schema().await.expect("second apply_schema must be a no-op");
+        recorder
+            .apply_schema()
+            .await
+            .expect("second apply_schema must be a no-op");
     }
 
     // ── record_state ──────────────────────────────────────────────────────────
@@ -613,7 +848,11 @@ mod tests {
     #[tokio::test]
     async fn record_state_inserts_row() {
         let recorder = open_memory().await;
-        let event = make_state_event("light.kitchen", "on", serde_json::json!({"brightness": 200}));
+        let event = make_state_event(
+            "light.kitchen",
+            "on",
+            serde_json::json!({"brightness": 200}),
+        );
 
         let state_id = recorder.record_state(&event).await.unwrap();
         assert!(state_id.is_some(), "expected a state_id");
@@ -652,19 +891,20 @@ mod tests {
         recorder.record_state(&e1).await.unwrap();
         recorder.record_state(&e2).await.unwrap();
 
-        let attr_count: (i64,) =
-            sqlx::query_as("SELECT COUNT(*) FROM state_attributes")
-                .fetch_one(&recorder.pool)
-                .await
-                .unwrap();
+        let attr_count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM state_attributes")
+            .fetch_one(&recorder.pool)
+            .await
+            .unwrap();
         // Both events share identical attrs → only one state_attributes row.
-        assert_eq!(attr_count.0, 1, "identical attrs must share one state_attributes row");
+        assert_eq!(
+            attr_count.0, 1,
+            "identical attrs must share one state_attributes row"
+        );
 
-        let state_count: (i64,) =
-            sqlx::query_as("SELECT COUNT(*) FROM states")
-                .fetch_one(&recorder.pool)
-                .await
-                .unwrap();
+        let state_count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM states")
+            .fetch_one(&recorder.pool)
+            .await
+            .unwrap();
         assert_eq!(state_count.0, 2, "two states rows expected");
     }
 
@@ -677,11 +917,10 @@ mod tests {
         recorder.record_state(&e1).await.unwrap();
         recorder.record_state(&e2).await.unwrap();
 
-        let attr_count: (i64,) =
-            sqlx::query_as("SELECT COUNT(*) FROM state_attributes")
-                .fetch_one(&recorder.pool)
-                .await
-                .unwrap();
+        let attr_count: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM state_attributes")
+            .fetch_one(&recorder.pool)
+            .await
+            .unwrap();
         assert_eq!(attr_count.0, 2);
     }
 
@@ -701,7 +940,10 @@ mod tests {
 
         let since = Utc::now() - chrono::Duration::seconds(10);
         let until = Utc::now() + chrono::Duration::seconds(10);
-        let rows = recorder.get_state_history(&eid, since, until).await.unwrap();
+        let rows = recorder
+            .get_state_history(&eid, since, until)
+            .await
+            .unwrap();
 
         assert_eq!(rows.len(), 3, "expected 3 history rows");
         // Verify ascending order by last_updated_ts.
@@ -749,11 +991,19 @@ mod tests {
         // FAILS against the old always-empty path: asserts real rows come back.
         let recorder = open_memory().await;
         recorder
-            .record_state(&make_state_event("light.kitchen", "on", serde_json::json!({})))
+            .record_state(&make_state_event(
+                "light.kitchen",
+                "on",
+                serde_json::json!({}),
+            ))
             .await
             .unwrap();
         recorder
-            .record_state(&make_state_event("light.bedroom", "off", serde_json::json!({})))
+            .record_state(&make_state_event(
+                "light.bedroom",
+                "off",
+                serde_json::json!({}),
+            ))
             .await
             .unwrap();
         recorder
@@ -789,7 +1039,10 @@ mod tests {
             ))
             .await
             .unwrap();
-        let rows = recorder.search_states_by_text("portland", 10).await.unwrap();
+        let rows = recorder
+            .search_states_by_text("portland", 10)
+            .await
+            .unwrap();
         assert_eq!(rows.len(), 1);
         assert_eq!(rows[0].entity_id.as_str(), "sensor.weather");
         assert_eq!(rows[0].attributes["location"], "portland");
@@ -816,7 +1069,11 @@ mod tests {
     async fn text_search_no_match_returns_empty() {
         let recorder = open_memory().await;
         recorder
-            .record_state(&make_state_event("light.kitchen", "on", serde_json::json!({})))
+            .record_state(&make_state_event(
+                "light.kitchen",
+                "on",
+                serde_json::json!({}),
+            ))
             .await
             .unwrap();
         let rows = recorder
@@ -839,7 +1096,11 @@ mod tests {
         // EntityId::parse permits this, so it reaches the bind path as data.
         let evil = "light.x_drop_table_states_select";
         recorder
-            .record_state(&make_state_event(evil, "'; DROP TABLE states; --", serde_json::json!({})))
+            .record_state(&make_state_event(
+                evil,
+                "'; DROP TABLE states; --",
+                serde_json::json!({}),
+            ))
             .await
             .unwrap();
 
@@ -897,7 +1158,11 @@ mod tests {
         let recorder = open_memory().await;
         for v in &["1", "2", "3", "4", "5"] {
             recorder
-                .record_state(&make_state_event("sensor.bounded", v, serde_json::json!({})))
+                .record_state(&make_state_event(
+                    "sensor.bounded",
+                    v,
+                    serde_json::json!({}),
+                ))
                 .await
                 .unwrap();
             tokio::time::sleep(std::time::Duration::from_millis(2)).await;
@@ -914,12 +1179,20 @@ mod tests {
         .fetch_all(&recorder.pool)
         .await
         .unwrap();
-        assert_eq!(capped.len(), 2, "LIMIT term effectively bounds the result set");
+        assert_eq!(
+            capped.len(),
+            2,
+            "LIMIT term effectively bounds the result set"
+        );
 
         // And the real method returns all rows when under the cap.
         let eid = entity("sensor.bounded");
         let rows = recorder
-            .get_state_history(&eid, Utc::now() - chrono::Duration::seconds(10), Utc::now() + chrono::Duration::seconds(10))
+            .get_state_history(
+                &eid,
+                Utc::now() - chrono::Duration::seconds(10),
+                Utc::now() + chrono::Duration::seconds(10),
+            )
             .await
             .unwrap();
         assert_eq!(rows.len(), 5, "all rows under the cap return");
@@ -947,7 +1220,10 @@ mod tests {
         // Read back the actual timestamps so the cutoff is exact.
         let since = Utc::now() - chrono::Duration::seconds(60);
         let until = Utc::now() + chrono::Duration::seconds(60);
-        let all = recorder.get_state_history(&eid, since, until).await.unwrap();
+        let all = recorder
+            .get_state_history(&eid, since, until)
+            .await
+            .unwrap();
         assert_eq!(all.len(), 3);
         // Cut off exactly at the middle row's timestamp.
         let mid_ts = all[1].last_updated_ts;
@@ -956,8 +1232,15 @@ mod tests {
         let stats = recorder.purge(cutoff).await.unwrap();
         assert_eq!(stats.states_deleted, 1, "only the strictly-older 'old' row");
 
-        let remaining = recorder.get_state_history(&eid, since, until).await.unwrap();
-        assert_eq!(remaining.len(), 2, "boundary 'mid' row is KEPT (exclusive cutoff)");
+        let remaining = recorder
+            .get_state_history(&eid, since, until)
+            .await
+            .unwrap();
+        assert_eq!(
+            remaining.len(),
+            2,
+            "boundary 'mid' row is KEPT (exclusive cutoff)"
+        );
         assert_eq!(remaining[0].state, "mid");
         assert_eq!(remaining[1].state, "new");
     }
@@ -995,18 +1278,28 @@ mod tests {
         // referenced by sensor.b, so it must survive.
         let eid_b = entity("sensor.b");
         let rows_b = recorder
-            .get_state_history(&eid_b, Utc::now() - chrono::Duration::seconds(60), Utc::now() + chrono::Duration::seconds(60))
+            .get_state_history(
+                &eid_b,
+                Utc::now() - chrono::Duration::seconds(60),
+                Utc::now() + chrono::Duration::seconds(60),
+            )
             .await
             .unwrap();
         let b_ts = rows_b[0].last_updated_ts;
         let cutoff = DateTime::<Utc>::from_timestamp_micros((b_ts * 1_000_000.0) as i64).unwrap();
         let stats = recorder.purge(cutoff).await.unwrap();
         assert_eq!(stats.states_deleted, 1, "sensor.a purged");
-        assert_eq!(stats.attributes_deleted, 0, "shared blob still referenced — kept");
+        assert_eq!(
+            stats.attributes_deleted, 0,
+            "shared blob still referenced — kept"
+        );
         assert_eq!(attr_count(&recorder).await, 1, "blob survives");
 
         // Now purge everything → sensor.b gone, blob orphaned → GC'd.
-        let stats2 = recorder.purge(Utc::now() + chrono::Duration::seconds(120)).await.unwrap();
+        let stats2 = recorder
+            .purge(Utc::now() + chrono::Duration::seconds(120))
+            .await
+            .unwrap();
         assert_eq!(stats2.states_deleted, 1, "sensor.b purged");
         assert_eq!(stats2.attributes_deleted, 1, "now-orphaned blob GC'd");
         assert_eq!(attr_count(&recorder).await, 0, "no blobs remain");
@@ -1017,7 +1310,11 @@ mod tests {
         let recorder = open_memory().await;
         let ctx = Context::new();
         recorder
-            .record_event(&DomainEvent::new("call_service", serde_json::json!({}), ctx))
+            .record_event(&DomainEvent::new(
+                "call_service",
+                serde_json::json!({}),
+                ctx,
+            ))
             .await
             .unwrap();
         // Purge with a far-future cutoff removes the event.
@@ -1039,11 +1336,95 @@ mod tests {
         // real rows via the text fallback — proving it's no longer always-empty.
         let recorder = open_memory().await;
         recorder
-            .record_state(&make_state_event("light.kitchen", "on", serde_json::json!({})))
+            .record_state(&make_state_event(
+                "light.kitchen",
+                "on",
+                serde_json::json!({}),
+            ))
             .await
             .unwrap();
         let rows = recorder.search_semantic("kitchen", 5).await.unwrap();
         assert_eq!(rows.len(), 1, "fallback must surface the kitchen row");
         assert_eq!(rows[0].entity_id.as_str(), "light.kitchen");
     }
+
+    #[tokio::test]
+    async fn latest_states_is_deterministic_newest_per_entity() {
+        let recorder = open_memory().await;
+        recorder
+            .record_state(&make_state_event("sensor.z", "old", serde_json::json!({})))
+            .await
+            .unwrap();
+        recorder
+            .record_state(&make_state_event("sensor.a", "only", serde_json::json!({})))
+            .await
+            .unwrap();
+        recorder
+            .record_state(&make_state_event("sensor.z", "new", serde_json::json!({})))
+            .await
+            .unwrap();
+
+        let batch = recorder.latest_states(10).await.unwrap();
+        assert_eq!(batch.states.len(), 2);
+        assert_eq!(batch.states[0].entity_id.as_str(), "sensor.a");
+        assert_eq!(batch.states[1].entity_id.as_str(), "sensor.z");
+        assert_eq!(batch.states[1].state, "new");
+        assert!(batch
+            .states
+            .iter()
+            .all(|state| state.context.is_restoration()));
+    }
+
+    #[tokio::test]
+    async fn latest_states_isolates_malformed_rows_and_honours_bound() {
+        let recorder = open_memory().await;
+        recorder
+            .record_state(&make_state_event(
+                "sensor.good",
+                "ok",
+                serde_json::json!({"x": 1}),
+            ))
+            .await
+            .unwrap();
+        sqlx::query(
+            "INSERT INTO states \
+             (entity_id, state, attributes_id, last_changed_ts, last_updated_ts, context_id) \
+             VALUES ('INVALID', 'bad', NULL, 1.0, 2.0, NULL)",
+        )
+        .execute(&recorder.pool)
+        .await
+        .unwrap();
+        let attrs_id = sqlx::query(
+            "INSERT INTO state_attributes (shared_attrs, hash) VALUES ('not-json', 424242)",
+        )
+        .execute(&recorder.pool)
+        .await
+        .unwrap()
+        .last_insert_rowid();
+        sqlx::query(
+            "INSERT INTO states \
+             (entity_id, state, attributes_id, last_changed_ts, last_updated_ts, context_id) \
+             VALUES ('sensor.badattrs', 'bad', ?, 1.0, 2.0, NULL)",
+        )
+        .bind(attrs_id)
+        .execute(&recorder.pool)
+        .await
+        .unwrap();
+
+        let batch = recorder.latest_states(10).await.unwrap();
+        assert_eq!(batch.states.len(), 1);
+        assert_eq!(batch.warnings.len(), 2);
+        assert!(batch
+            .warnings
+            .iter()
+            .any(|warning| matches!(warning, RestoreWarning::MalformedEntityId { .. })));
+        assert!(batch
+            .warnings
+            .iter()
+            .any(|warning| matches!(warning, RestoreWarning::MalformedAttributes { .. })));
+
+        let bounded = recorder.latest_states(1).await.unwrap();
+        assert!(bounded.truncated);
+        assert!(bounded.states.len() <= 1);
+    }
 }
diff --git a/v2/crates/homecore-recorder/src/lib.rs b/v2/crates/homecore-recorder/src/lib.rs
index 9391607f..81280f90 100644
--- a/v2/crates/homecore-recorder/src/lib.rs
+++ b/v2/crates/homecore-recorder/src/lib.rs
@@ -30,7 +30,10 @@ pub mod schema;
 pub mod semantic;
 
 // Re-export the primary public API surface.
-pub use db::{PurgeStats, Recorder, RecorderError, SemanticIndex, StateRow, MAX_HISTORY_ROWS};
+pub use db::{
+    LatestStates, PurgeStats, Recorder, RecorderError, RestoreReport, RestoreWarning,
+    SemanticIndex, StateRow, MAX_HISTORY_ROWS, MAX_RESTORE_STATES,
+};
 pub use listener::RecorderListener;
 
 /// Null semantic index used when the `ruvector` feature is off.
diff --git a/v2/crates/homecore-server/Cargo.toml b/v2/crates/homecore-server/Cargo.toml
index b47db9c0..5a483acd 100644
--- a/v2/crates/homecore-server/Cargo.toml
+++ b/v2/crates/homecore-server/Cargo.toml
@@ -25,9 +25,10 @@ homecore           = { path = "../homecore",           version = "0.1.0-alpha.0"
 homecore-api       = { path = "../homecore-api",       version = "0.1.0-alpha.0" }
 homecore-plugins   = { path = "../homecore-plugins", version = "0.1.0-alpha.0", optional = true }
 homecore-recorder  = { path = "../homecore-recorder",  version = "0.1.0-alpha.0" }
+# Reuse version-gated registry envelope parsing in the isolated restore module.
+homecore-migrate   = { path = "../homecore-migrate",   version = "0.1.0-alpha.0" }
 homecore-automation = { path = "../homecore-automation", version = "0.1.0-alpha.0" }
 homecore-assist    = { path = "../homecore-assist",    version = "0.1.0-alpha.0" }
-# Migration crate is CLI-only; not linked here.
 
 tokio = { version = "1", features = ["full"] }
 tracing = "0.1"
@@ -57,6 +58,7 @@ futures = "0.3"
 # Drive the assembled router in integration tests via ServiceExt::oneshot.
 tower = { version = "0.5", features = ["util"] }
 http-body-util = "0.1"
+tempfile = "3"
 
 [features]
 default = []
diff --git a/v2/crates/homecore-server/README.md b/v2/crates/homecore-server/README.md
index 9784658d..3c62d359 100644
--- a/v2/crates/homecore-server/README.md
+++ b/v2/crates/homecore-server/README.md
@@ -26,6 +26,11 @@ a default token. Configure allowed browser origins with
 ## Runtime behavior
 
 - SQLite recording is enabled by default at `sqlite://homecore.db`.
+- Entity/device registries are restored from `.homecore/storage` before
+  recorder states, listeners, automations, and API startup.
+- The latest recorder state for each entity is restored deterministically.
+  Restored snapshots retain their timestamps and carry a `homecore.restore`
+  context marker; malformed rows are logged and isolated.
 - Synthetic entities are disabled by default; opt in with
   `--seed-demo-entities`.
 - Automations can be loaded with `--automations <file>` or
@@ -67,6 +72,8 @@ unregistered and return an error rather than a false acknowledgement.
 |---|---|---|
 | `--bind` | `HOMECORE_BIND` | `0.0.0.0:8123` |
 | `--db` | `HOMECORE_DB` | `sqlite://homecore.db` |
+| `--storage-dir` | `HOMECORE_STORAGE_DIR` | `.homecore/storage` |
+| `--restore-limit` | `HOMECORE_RESTORE_LIMIT` | `100000` |
 | `--location-name` | `HOMECORE_LOCATION` | `Home` |
 | `--automations` | `HOMECORE_AUTOMATIONS` | unset |
 | `--insecure-dev-auth` | `HOMECORE_INSECURE_DEV_AUTH` | `false` |
diff --git a/v2/crates/homecore-server/src/main.rs b/v2/crates/homecore-server/src/main.rs
index 305dc3ae..2396a4f3 100644
--- a/v2/crates/homecore-server/src/main.rs
+++ b/v2/crates/homecore-server/src/main.rs
@@ -37,6 +37,7 @@ use tower_http::services::ServeDir;
 use tower_http::trace::TraceLayer;
 
 mod gateway;
+mod restore;
 use gateway::{GatewayConfig, GatewayState};
 
 /// Compile-time default location of the HOMECORE-UI assets (ADR-131).
@@ -83,6 +84,18 @@ struct Cli {
     #[arg(long, env = "HOMECORE_DB", default_value = "sqlite://homecore.db")]
     db: String,
 
+    /// HOMECORE registry storage directory restored at startup.
+    #[arg(
+        long,
+        env = "HOMECORE_STORAGE_DIR",
+        default_value = ".homecore/storage"
+    )]
+    storage_dir: std::path::PathBuf,
+
+    /// Maximum registry rows and latest entity states restored at startup.
+    #[arg(long, env = "HOMECORE_RESTORE_LIMIT", default_value_t = 100_000)]
+    restore_limit: usize,
+
     /// Friendly location name surfaced via `/api/config`.
     #[arg(long, env = "HOMECORE_LOCATION", default_value = "Home")]
     location_name: String,
@@ -140,6 +153,30 @@ async fn main() -> Result<()> {
     let hc = HomeCore::new();
     info!("HomeCore state machine + event bus + service registry online");
 
+    let recorder = if cli.no_recorder {
+        None
+    } else {
+        match open_recorder(&cli.db).await {
+            Ok(recorder) => Some(recorder),
+            Err(error) => {
+                warn!("Recorder failed to open ({error}) — continuing without persistence");
+                None
+            }
+        }
+    };
+    let restored =
+        restore::restore_startup(&hc, recorder.as_ref(), &cli.storage_dir, cli.restore_limit).await;
+    info!(
+        entities = restored.entity_entries,
+        devices = restored.device_entries,
+        states = restored.states,
+        truncated = restored.truncated,
+        "Startup restoration complete"
+    );
+    for warning in restored.warnings {
+        warn!("{warning}");
+    }
+
     // Seed a representative set of built-in services so the web UI
     // and HA-wire-compat clients see a populated /api/services on
     // first boot. These are no-op handlers (they just echo back the
@@ -158,21 +195,14 @@ async fn main() -> Result<()> {
     }
 
     // ── 2. Recorder (optional) ──────────────────────────────────────
-    if !cli.no_recorder {
-        match open_recorder(&cli.db).await {
-            Ok(recorder) => {
-                let _recorder_task = RecorderListener::new(hc.states(), recorder).spawn();
-                info!(
-                    "Recorder open at {} — state_changed events being persisted",
-                    cli.db
-                );
-            }
-            Err(e) => {
-                warn!("Recorder failed to open ({e}) — continuing without persistence");
-            }
-        }
+    if let Some(recorder) = recorder {
+        let _recorder_task = RecorderListener::new(hc.states(), recorder).spawn();
+        info!(
+            "Recorder open at {} — state_changed events being persisted",
+            cli.db
+        );
     } else {
-        info!("Recorder disabled by --no-recorder");
+        info!("Recorder unavailable or disabled");
     }
 
     // ── 3. Plugin runtime ───────────────────────────────────────────
diff --git a/v2/crates/homecore-server/src/restore.rs b/v2/crates/homecore-server/src/restore.rs
new file mode 100644
index 00000000..6a4acdc0
--- /dev/null
+++ b/v2/crates/homecore-server/src/restore.rs
@@ -0,0 +1,219 @@
+//! Bounded startup restoration for registries and latest recorder states.
+
+use std::path::Path;
+
+use homecore::{DeviceEntry, EntityEntry, HomeCore};
+use homecore_migrate::storage::read_envelope;
+use homecore_recorder::{Recorder, RestoreWarning};
+use serde::de::DeserializeOwned;
+
+pub const MAX_REGISTRY_ENTRIES: usize = 100_000;
+pub const MAX_REGISTRY_FILE_BYTES: u64 = 64 * 1024 * 1024;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RestorePhase {
+    EntityRegistry,
+    DeviceRegistry,
+    States,
+}
+
+#[derive(Debug, Default)]
+pub struct StartupRestoreReport {
+    pub entity_entries: usize,
+    pub device_entries: usize,
+    pub states: usize,
+    pub warnings: Vec<String>,
+    pub truncated: bool,
+    pub phases: Vec<RestorePhase>,
+}
+
+pub async fn restore_startup(
+    homecore: &HomeCore,
+    recorder: Option<&Recorder>,
+    storage_dir: &Path,
+    limit: usize,
+) -> StartupRestoreReport {
+    let limit = limit.min(MAX_REGISTRY_ENTRIES);
+    let mut report = StartupRestoreReport::default();
+
+    report.phases.push(RestorePhase::EntityRegistry);
+    let entities_path = storage_dir.join("core.entity_registry");
+    if entities_path.exists() {
+        match load_rows::<EntityEntry>(&entities_path, "entities", limit, |entry| {
+            entry.entity_id.as_str().to_owned()
+        }) {
+            Ok(batch) => {
+                report.truncated |= batch.truncated;
+                report.warnings.extend(batch.warnings);
+                for entry in batch.rows {
+                    homecore.entities().register(entry).await;
+                    report.entity_entries += 1;
+                }
+            }
+            Err(error) => report.warnings.push(error),
+        }
+    }
+
+    report.phases.push(RestorePhase::DeviceRegistry);
+    let devices_path = storage_dir.join("core.device_registry");
+    if devices_path.exists() {
+        match load_rows::<DeviceEntry>(&devices_path, "devices", limit, |entry| entry.id.clone()) {
+            Ok(batch) => {
+                report.truncated |= batch.truncated;
+                report.warnings.extend(batch.warnings);
+                for entry in batch.rows {
+                    homecore.devices().register(entry).await;
+                    report.device_entries += 1;
+                }
+            }
+            Err(error) => report.warnings.push(error),
+        }
+    }
+
+    report.phases.push(RestorePhase::States);
+    if let Some(recorder) = recorder {
+        match recorder.restore_latest(homecore.states(), limit).await {
+            Ok(state_report) => {
+                report.states = state_report.restored;
+                report.truncated |= state_report.truncated;
+                report
+                    .warnings
+                    .extend(state_report.warnings.into_iter().map(format_state_warning));
+            }
+            Err(error) => report
+                .warnings
+                .push(format!("state restore failed: {error}")),
+        }
+    }
+    report
+}
+
+struct RowBatch<T> {
+    rows: Vec<T>,
+    warnings: Vec<String>,
+    truncated: bool,
+}
+
+fn load_rows<T: DeserializeOwned>(
+    path: &Path,
+    field: &str,
+    limit: usize,
+    key: impl Fn(&T) -> String,
+) -> Result<RowBatch<T>, String> {
+    let file_size = std::fs::metadata(path)
+        .map_err(|error| format!("{}: {error}", path.display()))?
+        .len();
+    if file_size > MAX_REGISTRY_FILE_BYTES {
+        return Err(format!(
+            "{}: registry file is {file_size} bytes, exceeding the {} byte startup bound",
+            path.display(),
+            MAX_REGISTRY_FILE_BYTES
+        ));
+    }
+    let envelope = read_envelope(path).map_err(|error| error.to_string())?;
+    if envelope.version != 1 || envelope.minor_version > 13 {
+        return Err(format!(
+            "{}: unsupported registry version {}.{}",
+            path.display(),
+            envelope.version,
+            envelope.minor_version
+        ));
+    }
+    let values = envelope
+        .data
+        .get(field)
+        .and_then(serde_json::Value::as_array)
+        .ok_or_else(|| format!("{}: missing data.{field} array", path.display()))?;
+    let scan_limit = limit.saturating_add(1).min(MAX_REGISTRY_ENTRIES + 1);
+    let mut rows = Vec::with_capacity(values.len().min(scan_limit));
+    let mut warnings = Vec::new();
+    for (index, value) in values.iter().take(scan_limit).enumerate() {
+        match serde_json::from_value::<T>(value.clone()) {
+            Ok(row) => rows.push(row),
+            Err(error) => warnings.push(format!(
+                "{}: isolated malformed data.{field}[{index}]: {error}",
+                path.display()
+            )),
+        }
+    }
+    rows.sort_by_key(&key);
+    let truncated = values.len() > limit || rows.len() > limit;
+    rows.truncate(limit);
+    Ok(RowBatch {
+        rows,
+        warnings,
+        truncated,
+    })
+}
+
+fn format_state_warning(warning: RestoreWarning) -> String {
+    format!("isolated malformed recorder row: {warning:?}")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use homecore::{Context, EntityId};
+    use homecore_recorder::Recorder;
+
+    #[tokio::test]
+    async fn restores_registries_before_states_and_isolates_bad_rows() {
+        let dir = tempfile::tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("core.entity_registry"),
+            r#"{"version":1,"minor_version":13,"key":"core.entity_registry","data":{"entities":[
+              {"entity_id":"sensor.good","unique_id":null,"platform":"test","name":null,"disabled_by":null,"area_id":null,"device_id":"dev1","entity_category":null,"config_entry_id":null},
+              {"entity_id":"INVALID","platform":"bad"}
+            ]}}"#,
+        )
+        .unwrap();
+        std::fs::write(
+            dir.path().join("core.device_registry"),
+            r#"{"version":1,"minor_version":13,"key":"core.device_registry","data":{"devices":[
+              {"id":"dev1","config_entries":[],"identifiers":[],"connections":[],"manufacturer":null,"model":null,"model_id":null,"name":"Device","name_by_user":null,"sw_version":null,"hw_version":null,"serial_number":null,"via_device_id":null,"area_id":null,"entry_type":null,"disabled_by":null,"configuration_url":null,"labels":[],"primary_config_entry":null}
+            ]}}"#,
+        )
+        .unwrap();
+        let recorder = Recorder::open("sqlite::memory:").await.unwrap();
+        let source = HomeCore::new();
+        source.states().set(
+            EntityId::parse("sensor.good").unwrap(),
+            "on",
+            serde_json::json!({"restorable": true}),
+            Context::new(),
+        );
+        let mut receiver = source.states().subscribe();
+        // Force one recorder row from a real state event.
+        source.states().set(
+            EntityId::parse("sensor.good").unwrap(),
+            "off",
+            serde_json::json!({"restorable": true}),
+            Context::new(),
+        );
+        recorder
+            .record_state(&receiver.recv().await.unwrap())
+            .await
+            .unwrap();
+
+        let target = HomeCore::new();
+        let report =
+            restore_startup(&target, Some(&recorder), dir.path(), MAX_REGISTRY_ENTRIES).await;
+        assert_eq!(
+            report.phases,
+            vec![
+                RestorePhase::EntityRegistry,
+                RestorePhase::DeviceRegistry,
+                RestorePhase::States
+            ]
+        );
+        assert_eq!(report.entity_entries, 1);
+        assert_eq!(report.device_entries, 1);
+        assert_eq!(report.states, 1);
+        assert!(!report.warnings.is_empty());
+        let state = target
+            .states()
+            .get(&EntityId::parse("sensor.good").unwrap())
+            .unwrap();
+        assert!(state.context.is_restoration());
+    }
+}
diff --git a/v2/crates/homecore/src/event.rs b/v2/crates/homecore/src/event.rs
index 8caa3232..824a8caa 100644
--- a/v2/crates/homecore/src/event.rs
+++ b/v2/crates/homecore/src/event.rs
@@ -47,6 +47,9 @@ pub struct Context {
 }
 
 impl Context {
+    /// Marker stored on snapshots loaded from durable state at startup.
+    pub const RESTORE_USER_ID: &'static str = "homecore.restore";
+
     pub fn new() -> Self {
         Self::default()
     }
@@ -66,6 +69,20 @@ impl Context {
             parent_id: Some(parent.id),
         }
     }
+
+    /// Create a fresh context that identifies a startup restoration. The
+    /// persisted context, when valid, is retained as the causal parent.
+    pub fn restoration(parent_id: Option<Uuid>) -> Self {
+        Self {
+            id: Uuid::new_v4(),
+            user_id: Some(Self::RESTORE_USER_ID.to_owned()),
+            parent_id,
+        }
+    }
+
+    pub fn is_restoration(&self) -> bool {
+        self.user_id.as_deref() == Some(Self::RESTORE_USER_ID)
+    }
 }
 
 impl Default for Context {
diff --git a/v2/crates/homecore/src/homecore.rs b/v2/crates/homecore/src/homecore.rs
index 41410ed6..5f242ae1 100644
--- a/v2/crates/homecore/src/homecore.rs
+++ b/v2/crates/homecore/src/homecore.rs
@@ -6,7 +6,7 @@
 use std::sync::Arc;
 
 use crate::bus::EventBus;
-use crate::registry::EntityRegistry;
+use crate::registry::{DeviceRegistry, EntityRegistry};
 use crate::service::ServiceRegistry;
 use crate::state::StateMachine;
 
@@ -20,6 +20,7 @@ struct HomeCoreInner {
     pub states: StateMachine,
     pub services: ServiceRegistry,
     pub entities: EntityRegistry,
+    pub devices: DeviceRegistry,
 }
 
 impl HomeCore {
@@ -31,6 +32,7 @@ impl HomeCore {
                 services: ServiceRegistry::with_event_bus(bus.clone()),
                 bus,
                 entities: EntityRegistry::new(),
+                devices: DeviceRegistry::new(),
             }),
         }
     }
@@ -50,6 +52,10 @@ impl HomeCore {
     pub fn entities(&self) -> &EntityRegistry {
         &self.inner.entities
     }
+
+    pub fn devices(&self) -> &DeviceRegistry {
+        &self.inner.devices
+    }
 }
 
 impl Default for HomeCore {
diff --git a/v2/crates/homecore/src/lib.rs b/v2/crates/homecore/src/lib.rs
index ef0b7e39..7f5243ab 100644
--- a/v2/crates/homecore/src/lib.rs
+++ b/v2/crates/homecore/src/lib.rs
@@ -11,7 +11,7 @@
 //! - [`state`] — `StateMachine`: DashMap-backed concurrent state store
 //! - [`bus`] — `EventBus`: tokio broadcast wiring for system + domain events
 //! - [`service`] — `ServiceRegistry` (stub; full mpsc dispatch lands in P2)
-//! - [`registry`] — `EntityRegistry` (in-memory P1; persistence lands in P2)
+//! - [`registry`] — in-memory entity and device registries, restored by the server
 //! - [`homecore`] — `HomeCore` runtime coordinator: holds bus + states + services
 //!
 //! ## Threading model
@@ -23,31 +23,30 @@
 //!
 //! ## What's NOT here yet (deferred to P2+)
 //!
-//! - Persistence of entity registry to `.homecore/storage/core.entity_registry`
+//! - Automatic persistence of registry mutations (startup restoration exists)
 //! - Schema validation (`schemas` module from §3 stub)
 //! - Service handler mpsc dispatch (`service::ServiceRegistry::call`)
-//! - Device registry (mirror of HA's `core.device_registry`)
 //! - Witness chain integration (ADR-028)
 //!
 //! Each is marked `// TODO P2:` at the relevant call site.
 
+pub mod bus;
 pub mod entity;
 pub mod event;
-pub mod state;
-pub mod bus;
-pub mod service;
 pub mod registry;
+pub mod service;
+pub mod state;
 
 mod homecore;
 
 pub use homecore::HomeCore;
 
+pub use bus::EventBus;
 pub use entity::{EntityId, EntityIdError, State};
 pub use event::{Context, DomainEvent, EventType, StateChangedEvent, SystemEvent};
-pub use state::StateMachine;
-pub use bus::EventBus;
+pub use registry::{DeviceEntry, DeviceRegistry, EntityCategory, EntityEntry, EntityRegistry};
 pub use service::{ServiceCall, ServiceError, ServiceName, ServiceRegistry};
-pub use registry::{EntityCategory, EntityEntry, EntityRegistry};
+pub use state::StateMachine;
 
 /// HOMECORE protocol/data-model version. Bumped when the public surface
 /// or on-disk persistence schema changes in a backwards-incompatible way.
diff --git a/v2/crates/homecore/src/registry.rs b/v2/crates/homecore/src/registry.rs
index a5ffd053..d21dcfc0 100644
--- a/v2/crates/homecore/src/registry.rs
+++ b/v2/crates/homecore/src/registry.rs
@@ -1,9 +1,9 @@
-//! In-memory entity registry (P1). Persistence to
-//! `.homecore/storage/core.entity_registry` lands in P2.
+//! In-memory entity and device registries. Durable files are loaded by
+//! `homecore-server` during bounded startup restoration.
 //!
 //! Schema fields mirror HA `core.entity_registry` v13 per ADR-127 §2.4.
 
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap, HashSet};
 use std::sync::Arc;
 
 use serde::{Deserialize, Serialize};
@@ -43,6 +43,41 @@ pub struct EntityEntry {
     pub config_entry_id: Option<String>,
 }
 
+/// Physical-device metadata persisted in `core.device_registry`.
+///
+/// The fields track the HA v13 registry surface used by HOMECORE. Identifier
+/// and connection pairs are sets because their order is not semantically
+/// meaningful in HA.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub struct DeviceEntry {
+    pub id: String,
+    #[serde(default)]
+    pub config_entries: HashSet<String>,
+    #[serde(default)]
+    pub identifiers: HashSet<(String, String)>,
+    #[serde(default)]
+    pub connections: HashSet<(String, String)>,
+    pub manufacturer: Option<String>,
+    pub model: Option<String>,
+    pub model_id: Option<String>,
+    pub name: Option<String>,
+    pub name_by_user: Option<String>,
+    pub sw_version: Option<String>,
+    pub hw_version: Option<String>,
+    pub serial_number: Option<String>,
+    pub via_device_id: Option<String>,
+    pub area_id: Option<String>,
+    pub entry_type: Option<String>,
+    pub disabled_by: Option<String>,
+    pub configuration_url: Option<String>,
+    #[serde(default)]
+    pub labels: HashSet<String>,
+    pub primary_config_entry: Option<String>,
+    /// Forward-compatible device fields from newer HA v13-compatible rows.
+    #[serde(default, flatten)]
+    pub extra: BTreeMap<String, serde_json::Value>,
+}
+
 #[derive(Clone)]
 pub struct EntityRegistry {
     entries: Arc<RwLock<HashMap<EntityId, EntityEntry>>>,
@@ -89,6 +124,45 @@ impl Default for EntityRegistry {
     }
 }
 
+#[derive(Clone)]
+pub struct DeviceRegistry {
+    entries: Arc<RwLock<HashMap<String, DeviceEntry>>>,
+}
+
+impl DeviceRegistry {
+    pub fn new() -> Self {
+        Self {
+            entries: Arc::new(RwLock::new(HashMap::new())),
+        }
+    }
+
+    pub async fn register(&self, entry: DeviceEntry) {
+        self.entries.write().await.insert(entry.id.clone(), entry);
+    }
+
+    pub async fn get(&self, id: &str) -> Option<DeviceEntry> {
+        self.entries.read().await.get(id).cloned()
+    }
+
+    pub async fn all(&self) -> Vec<DeviceEntry> {
+        self.entries.read().await.values().cloned().collect()
+    }
+
+    pub async fn len(&self) -> usize {
+        self.entries.read().await.len()
+    }
+
+    pub async fn is_empty(&self) -> bool {
+        self.entries.read().await.is_empty()
+    }
+}
+
+impl Default for DeviceRegistry {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/v2/crates/homecore/src/state.rs b/v2/crates/homecore/src/state.rs
index 44dca460..c1f4d553 100644
--- a/v2/crates/homecore/src/state.rs
+++ b/v2/crates/homecore/src/state.rs
@@ -14,7 +14,6 @@
 //!
 //! - `async_set_internal` schema validation
 //! - Bulk delete of an entire domain (`async_remove_domain`)
-//! - Restore-state on startup from the recorder (ADR-132)
 
 use std::sync::Arc;
 
@@ -158,6 +157,19 @@ impl StateMachine {
         next
     }
 
+    /// Install a durable snapshot during startup without emitting a new
+    /// state-change event. Callers must mark the snapshot context as a
+    /// restoration; this prevents accidental use as a silent runtime write.
+    pub fn restore(&self, snapshot: State) -> Result<Arc<State>, RestoreStateError> {
+        if !snapshot.context.is_restoration() {
+            return Err(RestoreStateError::UnmarkedContext);
+        }
+        let entity_id = snapshot.entity_id.clone();
+        let snapshot = Arc::new(snapshot);
+        self.inner.states.insert(entity_id, Arc::clone(&snapshot));
+        Ok(snapshot)
+    }
+
     /// Remove a state. Fires `state_changed` with `new_state = None`.
     pub fn remove(&self, entity_id: &EntityId) -> Option<Arc<State>> {
         let removed = self.inner.states.remove(entity_id).map(|(_, s)| s);
@@ -213,6 +225,12 @@ impl Default for StateMachine {
     }
 }
 
+#[derive(Debug, thiserror::Error, PartialEq, Eq)]
+pub enum RestoreStateError {
+    #[error("restored state context is not marked as a restoration")]
+    UnmarkedContext,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

From c2abe53e92e232452d6a6004ebd4d3a156d65190 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:15:05 -0400
Subject: [PATCH 05/16] feat(homecore-hap): add fail-closed network foundation

---
 v2/Cargo.lock                          |   4 +
 v2/crates/homecore-hap/Cargo.toml      |  16 +-
 v2/crates/homecore-hap/README.md       | 189 +++--
 v2/crates/homecore-hap/src/bridge.rs   | 119 +++-
 v2/crates/homecore-hap/src/error.rs    |  28 +
 v2/crates/homecore-hap/src/lib.rs      |  31 +-
 v2/crates/homecore-hap/src/mdns.rs     | 231 ++++++-
 v2/crates/homecore-hap/src/pairing.rs  | 366 ++++++++++
 v2/crates/homecore-hap/src/protocol.rs | 129 ++++
 v2/crates/homecore-hap/src/server.rs   | 911 +++++++++++++++++++++++++
 v2/crates/homecore-hap/src/session.rs  | 212 ++++++
 11 files changed, 2064 insertions(+), 172 deletions(-)
 create mode 100644 v2/crates/homecore-hap/src/pairing.rs
 create mode 100644 v2/crates/homecore-hap/src/protocol.rs
 create mode 100644 v2/crates/homecore-hap/src/server.rs
 create mode 100644 v2/crates/homecore-hap/src/session.rs

diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index 5f0b13fa..417f9a75 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -3600,9 +3600,13 @@ name = "homecore-hap"
 version = "0.1.0-alpha.0"
 dependencies = [
  "async-trait",
+ "ed25519-dalek",
  "homecore",
+ "httparse",
+ "mdns-sd",
  "serde",
  "serde_json",
+ "tempfile",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
diff --git a/v2/crates/homecore-hap/Cargo.toml b/v2/crates/homecore-hap/Cargo.toml
index a4ebe91a..537d196d 100644
--- a/v2/crates/homecore-hap/Cargo.toml
+++ b/v2/crates/homecore-hap/Cargo.toml
@@ -10,7 +10,7 @@ version = "0.1.0-alpha.0"
 edition = "2021"
 license = "MIT"
 authors = ["rUv <ruv@ruv.net>", "HOMECORE Contributors"]
-description = "Apple Home HomeKit Accessory Protocol bridge — ADR-125 P1 scaffold"
+description = "Fail-closed HomeKit Accessory Protocol network foundation for HOMECORE"
 repository = "https://github.com/ruvnet/wifi-densepose"
 
 [lib]
@@ -19,18 +19,24 @@ path = "src/lib.rs"
 
 [features]
 default = []
-# P2: gates the actual hap = "0.1" crate integration + real mDNS via mdns-sd
-hap-server = []
+# Enables the bounded TCP/HTTP listener and real `_hap._tcp` mDNS advertiser.
+# Pair-Setup, Pair-Verify, and encrypted HAP transport remain deliberately
+# unavailable until their complete cryptographic phases are implemented.
+hap-server = ["dep:httparse", "dep:mdns-sd"]
 
 [dependencies]
 homecore = { path = "../homecore" }
-tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros"] }
+tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "rt", "rt-multi-thread", "sync", "time"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"
 tracing = "0.1"
 async-trait = "0.1"
 uuid = { version = "1", features = ["v4", "serde"] }
+ed25519-dalek = "2.1"
+tempfile = "3"
+httparse = { version = "1", optional = true }
+mdns-sd = { version = "0.11", optional = true }
 
 [dev-dependencies]
-tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros", "test-util"] }
+tokio = { version = "1", features = ["fs", "io-util", "macros", "net", "rt", "rt-multi-thread", "sync", "time", "test-util"] }
diff --git a/v2/crates/homecore-hap/README.md b/v2/crates/homecore-hap/README.md
index 5c5635e1..5eb54c8d 100644
--- a/v2/crates/homecore-hap/README.md
+++ b/v2/crates/homecore-hap/README.md
@@ -1,121 +1,112 @@
 # homecore-hap
 
-Apple Home HomeKit Accessory Protocol bridge for HOMECORE with HAP-1.1 trait surface and mDNS advertisement (P2).
+`homecore-hap` is the fail-closed network foundation for HOMECORE's Apple
+HomeKit Accessory Protocol bridge (ADR-125). It maps HOMECORE entities to HAP
+services and provides the bounded server, persistence, discovery, and request
+gating needed by a complete HAP implementation.
 
-[![Crates.io](https://img.shields.io/crates/v/homecore-hap.svg)](https://crates.io/crates/homecore-hap)
-![License](https://img.shields.io/badge/license-MIT-blue.svg)
-![MSRV: 1.89+](https://img.shields.io/badge/MSRV-1.89%2B-purple.svg)
-[![Tests](https://img.shields.io/badge/tests-17%20passing-brightgreen.svg)](https://github.com/ruvnet/RuView)
-[![ADR-125](https://img.shields.io/badge/ADR-125-orange.svg)](../../docs/adr/ADR-125-homecore-apple-home-homekit-bridge.md)
+It does **not currently complete Apple Home pairing**. Pairing requests receive
+a valid TLV8 `Unavailable` error, and accessory/characteristic endpoints return
+HTTP 470 until an authenticated Pair-Verify session exists. There is no
+plaintext header, bearer-token, or test credential bypass.
 
-**P1 scaffold**: trait surface for HAP accessories + characteristics, entity→HAP mapping rules, and bridge ownership. The actual HAP-1.1 TLS server and real mDNS integration are gated behind `--features hap-server` (P2).
+## Implemented
 
-## What this crate does
+- Bounded Tokio TCP lifecycle with connection, header, body, request-time, and
+  shutdown limits.
+- Incremental HTTP/1.1 parsing through `httparse`; duplicate
+  `Content-Length`, transfer encoding, truncated input, and oversized input
+  fail closed.
+- Versioned controller pairing records with bounded parsing, atomic same-
+  directory replacement, Unix `0600` files/`0700` created directories, and
+  refusal to load permissive or symlinked files.
+- Controller identifiers, administrator invariants, and Ed25519 public keys
+  validated through `ed25519-dalek`.
+- Session state machine for Connected, Pair-Setup, Pair-Verify, Authenticated,
+  and Closing. Authentication requires a valid signature from a persisted
+  controller over the Pair-Verify transcript supplied by the future protocol
+  phase.
+- Real `_hap._tcp.local.` advertisement through `mdns-sd` when
+  `hap-server` is enabled. `NullAdvertiser` provides deterministic,
+  network-free tests and deployments.
+- HAP-shaped `/accessories`, `/characteristics`, event subscription, and
+  `EVENT/1.0` flow backed by `HapBridge` snapshots and bounded broadcasts.
+  These handlers are structurally present but network-inaccessible until
+  encrypted Pair-Verify is complete.
 
-`homecore-hap` bridges HOMECORE entity state to Apple HomeKit Accessory Protocol (HAP-1.1), allowing HomeKit-native apps (Home, Control Center, Siri) to control HOMECORE devices. It provides:
+## Deliberately incomplete protocol phases
 
-- **HapAccessoryType enum** — 11 accessory types matching HA's HomeKit integration (`Light`, `Switch`, `Thermostat`, `Lock`, `Door`, etc.)
-- **HapCharacteristic enum** — HAP characteristic types (`On`, `Brightness`, `Temperature`, `TargetLockState`, etc.)
-- **EntityToAccessoryMapper** — bidirectional rules for mapping HOMECORE entities to HAP accessories (e.g., `light.kitchen` → `Light` accessory + `On` + `Brightness` characteristics)
-- **HapBridge** — owns and exposes a collection of mapped accessories over HAP
-- **MdnsAdvertiser trait** — abstraction over mDNS advertisement; P1 ships `NullAdvertiser` (no-op), P2 adds real mDNS via `mdns-sd`
-- **RuViewToHapMapper** — bridges RuView sensing data (temperature, humidity, occupancy) to HAP characteristics
+The following must land together before this crate may claim Apple Home
+interoperability:
 
-The bridge itself is a HAP Accessory Bridge (HAP-1.1 spec §8.3), advertising a single service with characteristic slots for each exposed accessory.
+1. Pair-Setup M1-M6: SRP-6a proof exchange, setup-code policy, accessory
+   Ed25519 identity persistence, HKDF derivation, and ChaCha20-Poly1305
+   encrypted sub-TLVs.
+2. Pair-Verify M1-M4: ephemeral X25519 exchange, accessory/controller Ed25519
+   transcript signatures, HKDF session derivation, and encrypted sub-TLVs.
+3. Encrypted HAP transport: length-prefixed frames, independent read/write
+   ChaCha20-Poly1305 keys and monotonically increasing nonces, with strict
+   frame limits and connection teardown on authentication failure.
+4. Authenticated `/pairings` add/remove/list semantics and live mDNS `sf`
+   updates.
+5. Stable persisted AID/IID allocation and a HOMECORE service-call adapter for
+   writable characteristics. The present endpoint is read/event-only.
+6. Validation against Apple Home or a known-conformant HAP controller,
+   including pair, restart, event delivery, write, unpair, and re-pair.
 
-## Features
+No cryptographic primitive should be implemented locally. The remaining work
+must use reviewed RustCrypto/PAKE crates and protocol test vectors.
 
-- **11 accessory types** — Light, Switch, Thermostat, Door, Lock, Window, Blind, Outlet, Fan, Sensor, SecuritySystem
-- **Bi-directional mapping** — HOMECORE entity state ↔ HAP characteristic values with type-safe enums
-- **HAP-1.1 spec compliance** — characteristic types and permissions match HomeKit's published spec
-- **Trait-based advertisement** — `MdnsAdvertiser` abstraction; swappable implementations (null, real mDNS, etc.)
-- **RuView integration** — maps WiFi sensing data (occupancy, temperature, vital signs) to HomeKit sensor accessories
-- **No TLS server in P1** — bridge compiles and tests pass with `--no-default-features`; real server lands in P2 with `--features hap-server`
-- **Home.app compatible** — exposed accessories appear in Home app on any HomeKit hub (Apple TV, HomePod, HomePod mini)
+## Server integration
 
-## Capabilities
+```rust,no_run
+use std::{net::IpAddr, sync::Arc};
+use homecore_hap::{
+    start_server, HapBridge, HapServerConfig, HapServiceRecord,
+    MdnsSdAdvertiser, PairingStore,
+};
 
-| Capability | Type | Method | Notes |
-|------------|------|--------|-------|
-| Define accessory type | Trait | `HapAccessoryType::Light` etc. (11 variants) | Enum; no instantiation yet (P1) |
-| Define characteristic | Trait | `HapCharacteristic::On`, `Brightness`, etc. | Enum; values encoded as HAP TLV |
-| Map entity to accessory | Mapping | `EntityToAccessoryMapper::map_light()` | Takes `EntityId` + `State`; returns `HapAccessory` |
-| Expose accessory | Bridge | `HapBridge::expose(accessory)` | Adds to the bridge's characteristic list |
-| Advertise bridge | mDNS | `NullAdvertiser::advertise()` (P1) | No-op stub; real mDNS in P2 |
-| Advertise bridge (P2) | mDNS | `mdns_sd::ServiceInstanceBuilder` | Real mDNS via `--features hap-server` |
-| Bridge state query | Bridge | `HapBridge::list_accessories()` | Returns exposed accessories + their characteristics |
-| Characteristic write | Characteristic | HAP `WriteRequest` TLV (P2) | Home.app button press → service call |
-| Characteristic read | Characteristic | HAP `ReadResponse` TLV (P2) | Home.app query → current entity state |
+# async fn run() -> Result<(), Box<dyn std::error::Error>> {
+let record = HapServiceRecord::bridge(
+    "HOMECORE Bridge",
+    51826,
+    "AA:BB:CC:DD:EE:FF",
+);
+let bridge = HapBridge::new(record);
+let pairings = Arc::new(PairingStore::open(
+    "/var/lib/homecore-hap/pairings.json",
+)?);
+let advertiser = Arc::new(MdnsSdAdvertiser::new(
+    "homecore",
+    "192.168.1.50".parse::<IpAddr>()?,
+)?);
 
-## Comparison to Home Assistant
+let server = start_server(
+    HapServerConfig::default(),
+    bridge.clone(),
+    pairings,
+    advertiser,
+).await?;
 
-| Aspect | Home Assistant | homecore-hap |
-|--------|----------------|--------------|
-| Framework | HA's `hap-python` (pure Python) | Rust 1.89+ with HAP trait abstraction |
-| Server type | Python asyncio HAP-1.1 server | TLS server trait (P2); stub in P1 |
-| Accessory types | 30+ (Light, Switch, Thermostat, etc.) | 11 (Light, Switch, Thermostat, Door, Lock, Window, Blind, Outlet, Fan, Sensor, SecuritySystem) |
-| mDNS | mdns-py broadcast via asyncio | Abstraction + real mDNS (P2) or no-op stub (P1) |
-| Entity filtering | YAML `include_domains` + `exclude_entities` | Mapper rules (planned P2) |
-| HomeKit hub requirement | Yes (for remote access) | Yes (same as HomeKit) |
-| Pairing code generation | Automatic (HA web UI) | Manual setup code (P2) |
-| Characteristic persistence | HomeKit cloud only | Paired with homecore state machine |
-
-## Performance
-
-- **Entity→HAP mapping** — < 100 μs per entity (enum lookups + type conversions)
-- **HAP write latency** — ~10 ms (TLS decrypt + characteristic parse + entity state set); bounded by homecore state machine lock contention
-- **mDNS advertisement** (P2) — ~50 ms multicast broadcast; periodic rediscovery on network change
-- **Memory overhead per accessory** — ~500 bytes (enum + characteristic slots + metadata)
-- **No per-crate benchmarks yet** — a follow-up issue tracks baseline measurements
-
-## Usage
-
-Mapping an entity (P1):
-
-```rust
-use homecore_hap::{EntityToAccessoryMapper, HapBridge, HapAccessoryType};
-use homecore::{EntityId, State};
-use std::collections::HashMap;
-
-#[tokio::main]
-async fn main() {
-    let light_id = EntityId::parse("light.kitchen").unwrap();
-    let state = State::new("on", HashMap::new());
-
-    // Map the entity to a HAP Light accessory
-    let mut mapper = EntityToAccessoryMapper::new();
-    if let Ok(accessory) = mapper.map_light(&light_id, &state) {
-        println!("Mapped to HAP: {:?}", accessory.accessory_type);
-
-        // Expose it via the bridge
-        let mut bridge = HapBridge::new();
-        bridge.expose(accessory);
-        println!("Exposed {} accessories", bridge.list_accessories().len());
-    }
-}
+// Feed HOMECORE StateChanged events through bridge.update_accessory(...).
+// On process shutdown:
+server.shutdown().await?;
+# Ok(())
+# }
 ```
 
-Real HAP server (P2, via `--features hap-server`):
+Build and test:
 
 ```bash
-cargo build -p homecore-hap --features hap-server
-# The server will advertise over mDNS and accept HomeKit pairing requests
+cargo test -p homecore-hap --no-default-features
+cargo test -p homecore-hap --features hap-server
 ```
 
-## Relation to other HOMECORE crates
+Real mDNS requires the advertised address to be LAN-routable and the runtime to
+have multicast access. Containers normally need host networking or macvlan.
 
-```
-homecore-hap (HomeKit bridge)
-├─ homecore (state machine; bridge reads entity states)
-├─ homecore-api (exposes HAP state via REST /api for remote debugging)
-├─ homecore-server (starts the bridge on homecore init)
-└─ homecore-automation (can trigger state changes via service calls)
-```
+## Decisions
 
-## References
-
-- [ADR-125: HOMECORE Apple Home / HomeKit Bridge](../../docs/adr/ADR-125-homecore-apple-home-homekit-bridge.md)
-- [ADR-126: HOMECORE Home Assistant Port (master)](../../docs/adr/ADR-126-homecore-home-assistant-port.md)
-- [HomeKit Accessory Protocol Specification (HAP-1.1)](https://developer.apple.com/homekit/)
-- [user-guide-apple-homepod.md](../../docs/user-guide-apple-homepod.md)
-- [README — wifi-densepose](../../../README.md)
+- [ADR-125 — native Apple Home HAP bridge](../../docs/adr/ADR-125-ruview-apple-home-native-hap-bridge.md)
+- [ADR-130 — bounded async REST/WebSocket server patterns](../../docs/adr/ADR-130-homecore-rest-websocket-api.md)
+- [ADR-161 — server-layer security and explicit HAP deferral](../../docs/adr/ADR-161-homecore-server-layer-security.md)
diff --git a/v2/crates/homecore-hap/src/bridge.rs b/v2/crates/homecore-hap/src/bridge.rs
index faa66185..435d8f1c 100644
--- a/v2/crates/homecore-hap/src/bridge.rs
+++ b/v2/crates/homecore-hap/src/bridge.rs
@@ -1,15 +1,15 @@
 //! `HapBridge` — owns the set of HOMECORE entities exposed as HAP accessories.
 //!
-//! P1 does not start a real HAP-1.1 server; it ships the API surface so other
-//! crates (and P2's `hap-server` feature) can register accessories and query
-//! their current mapping. The actual mDNS + HAP pairing is gated to P2.
+//! The bridge owns mappings and their event stream. The feature-gated network
+//! lifecycle is started separately with `start_server`.
 
 use std::collections::HashMap;
 use std::sync::{Arc, RwLock};
 
 use homecore::entity::EntityId;
+use tokio::sync::broadcast;
 
-use crate::accessory::HapAccessoryType;
+use crate::accessory::{HapAccessoryType, HapCharacteristic, HapCharacteristicValue};
 use crate::error::HapError;
 use crate::mapping::{AccessoryMapping, EntityToAccessoryMapper};
 use crate::mdns::{HapServiceRecord, MdnsAdvertiser, NullAdvertiser};
@@ -22,37 +22,49 @@ pub struct ExposedAccessory {
     pub mapping: AccessoryMapping,
 }
 
+/// A characteristic snapshot emitted after a registered entity changes.
+#[derive(Debug, Clone)]
+pub struct CharacteristicEvent {
+    pub entity_id: EntityId,
+    pub accessory_type: HapAccessoryType,
+    pub characteristics: Vec<(HapCharacteristic, HapCharacteristicValue)>,
+}
+
 struct BridgeInner {
     accessories: HashMap<EntityId, ExposedAccessory>,
 }
 
-/// The P1 HAP bridge.
+/// HOMECORE-to-HAP accessory bridge state.
 ///
 /// Call [`HapBridge::add_accessory`] to register entities and
 /// [`HapBridge::running_accessories`] to read back what is currently
-/// registered. In P2, `start()` will spawn the `hap` server task.
+/// registered. Use `start_server` for the bounded TCP lifecycle.
 #[derive(Clone)]
 pub struct HapBridge {
     inner: Arc<RwLock<BridgeInner>>,
     advertiser: Arc<dyn MdnsAdvertiser>,
+    events: broadcast::Sender<CharacteristicEvent>,
     pub service_record: HapServiceRecord,
 }
 
 impl HapBridge {
-    /// Create a bridge with the given service record and a `NullAdvertiser`
-    /// (P1 default — real mDNS lands in P2).
+    /// Create a bridge with the given service record and a `NullAdvertiser`.
     pub fn new(service_record: HapServiceRecord) -> Self {
         Self::with_advertiser(service_record, Arc::new(NullAdvertiser))
     }
 
-    /// Create a bridge with a custom `MdnsAdvertiser` (used in tests and P2).
+    /// Create a bridge with a custom `MdnsAdvertiser`.
     pub fn with_advertiser(
         service_record: HapServiceRecord,
         advertiser: Arc<dyn MdnsAdvertiser>,
     ) -> Self {
+        let (events, _) = broadcast::channel(128);
         Self {
-            inner: Arc::new(RwLock::new(BridgeInner { accessories: HashMap::new() })),
+            inner: Arc::new(RwLock::new(BridgeInner {
+                accessories: HashMap::new(),
+            })),
             advertiser,
+            events,
             service_record,
         }
     }
@@ -97,9 +109,46 @@ impl HapBridge {
         Ok(())
     }
 
+    /// Refresh a registered accessory and notify event subscribers.
+    pub fn update_accessory(
+        &self,
+        entity_id: &EntityId,
+        state: &homecore::entity::State,
+    ) -> Result<(), HapError> {
+        let mapping = EntityToAccessoryMapper::map(entity_id, state)?;
+        let accessory_type = mapping.accessory_type;
+        {
+            let mut inner = self.inner.write().unwrap();
+            let accessory = inner
+                .accessories
+                .get_mut(entity_id)
+                .ok_or_else(|| HapError::EntityNotFound(entity_id.as_str().to_owned()))?;
+            accessory.accessory_type = accessory_type;
+            accessory.mapping = mapping.clone();
+        }
+        let _ = self.events.send(CharacteristicEvent {
+            entity_id: entity_id.clone(),
+            accessory_type,
+            characteristics: mapping.characteristics,
+        });
+        Ok(())
+    }
+
+    /// Subscribe to bounded characteristic updates. Lagging receivers receive
+    /// Tokio's explicit `Lagged` error and must resynchronize from a snapshot.
+    pub fn subscribe_events(&self) -> broadcast::Receiver<CharacteristicEvent> {
+        self.events.subscribe()
+    }
+
     /// Snapshot all currently registered accessories.
     pub fn running_accessories(&self) -> Vec<ExposedAccessory> {
-        self.inner.read().unwrap().accessories.values().cloned().collect()
+        self.inner
+            .read()
+            .unwrap()
+            .accessories
+            .values()
+            .cloned()
+            .collect()
     }
 
     /// Number of registered accessories.
@@ -111,21 +160,25 @@ impl HapBridge {
         self.len() == 0
     }
 
-    /// P2 stub — will start the HAP-1.1 server + mDNS advertisement.
-    /// In P1 this only fires the null advertiser.
+    /// Start advertisement only.
+    ///
+    /// This legacy lifecycle does not bind a TCP listener. New integrations
+    /// should call `start_server`, which advertises only after binding.
     pub async fn start(&self) -> Result<(), HapError> {
         self.advertiser.advertise(&self.service_record).await?;
         tracing::info!(
             instance = %self.service_record.instance_name,
             port = self.service_record.port,
-            "HapBridge started (P1 — no real HAP server; mDNS stub only)"
+            "HAP advertisement started without a TCP server"
         );
         Ok(())
     }
 
     /// Graceful shutdown — retracts mDNS advertisement.
     pub async fn stop(&self) -> Result<(), HapError> {
-        self.advertiser.retract(&self.service_record.instance_name).await?;
+        self.advertiser
+            .retract(&self.service_record.instance_name)
+            .await?;
         Ok(())
     }
 }
@@ -137,18 +190,22 @@ mod tests {
     use homecore::event::Context;
 
     fn make_bridge() -> HapBridge {
-        HapBridge::new(HapServiceRecord {
-            instance_name: "RuView Sense".into(),
-            port: 51826,
-            setup_code: "111-22-333".into(),
-            device_id: "AA:BB:CC:DD:EE:FF".into(),
-        })
+        HapBridge::new(HapServiceRecord::bridge(
+            "RuView Sense",
+            51826,
+            "AA:BB:CC:DD:EE:FF",
+        ))
     }
 
     fn light_state(name: &str, on: bool, brightness: u8) -> (EntityId, State) {
-        let eid = EntityId::parse(&format!("light.{name}")).unwrap();
+        let eid = EntityId::parse(format!("light.{name}")).unwrap();
         let attrs = serde_json::json!({"brightness": brightness});
-        let s = State::new(eid.clone(), if on { "on" } else { "off" }, attrs, Context::default());
+        let s = State::new(
+            eid.clone(),
+            if on { "on" } else { "off" },
+            attrs,
+            Context::default(),
+        );
         (eid, s)
     }
 
@@ -187,6 +244,22 @@ mod tests {
         assert!(matches!(err, HapError::EntityNotFound(_)));
     }
 
+    #[tokio::test]
+    async fn update_emits_characteristic_event() {
+        let bridge = make_bridge();
+        let (eid, initial) = light_state("kitchen", false, 10);
+        bridge.add_accessory(&eid, &initial).unwrap();
+        let mut events = bridge.subscribe_events();
+        let (_, updated) = light_state("kitchen", true, 200);
+        bridge.update_accessory(&eid, &updated).unwrap();
+
+        let event = events.recv().await.unwrap();
+        assert_eq!(event.entity_id, eid);
+        assert!(event
+            .characteristics
+            .contains(&(HapCharacteristic::On, HapCharacteristicValue::Bool(true))));
+    }
+
     #[tokio::test]
     async fn start_stop_with_null_advertiser() {
         let bridge = make_bridge();
diff --git a/v2/crates/homecore-hap/src/error.rs b/v2/crates/homecore-hap/src/error.rs
index a7125616..223cd737 100644
--- a/v2/crates/homecore-hap/src/error.rs
+++ b/v2/crates/homecore-hap/src/error.rs
@@ -1,5 +1,6 @@
 //! Unified error type for `homecore-hap`.
 
+use std::path::PathBuf;
 use thiserror::Error;
 
 /// Errors produced by the HAP bridge and its sub-components.
@@ -19,4 +20,31 @@ pub enum HapError {
 
     #[error("bridge not running")]
     NotRunning,
+
+    #[error("pairing store error: {0}")]
+    PairingStore(String),
+
+    #[error("invalid pairing record: {0}")]
+    InvalidPairingRecord(String),
+
+    #[error("controller pairing already exists: {0}")]
+    PairingAlreadyExists(String),
+
+    #[error("controller pairing not found: {0}")]
+    PairingNotFound(String),
+
+    #[error("insecure permissions on {path}: mode {mode:o}; expected no group/other access")]
+    InsecurePermissions { path: PathBuf, mode: u32 },
+
+    #[error("invalid HAP session transition from {from} to {to}")]
+    InvalidSessionTransition {
+        from: &'static str,
+        to: &'static str,
+    },
+
+    #[error("HAP protocol error: {0}")]
+    Protocol(String),
+
+    #[error("HAP server error: {0}")]
+    Server(String),
 }
diff --git a/v2/crates/homecore-hap/src/lib.rs b/v2/crates/homecore-hap/src/lib.rs
index 931f2f8a..7b1f8359 100644
--- a/v2/crates/homecore-hap/src/lib.rs
+++ b/v2/crates/homecore-hap/src/lib.rs
@@ -1,12 +1,12 @@
 //! `homecore-hap` — Apple Home HomeKit Accessory Protocol bridge (ADR-125).
 //!
-//! # P1 scope
+//! # Network foundation scope
 //!
-//! Ships the trait surface and type definitions needed to map HOMECORE entity
-//! states onto HAP accessory / characteristic values. The actual HAP-1.1 TLS
-//! server and real mDNS advertisement are gated behind the `hap-server`
-//! feature (P2). P1 ships `NullAdvertiser` (no-op) so the bridge compiles and
-//! all tests pass with `--no-default-features`.
+//! The crate provides persisted controller records, a fail-closed session
+//! state machine, bounded TLV8 parsing, characteristic event flow, and (with
+//! `hap-server`) a bounded TCP/HTTP listener plus real mDNS. It does **not**
+//! yet implement SRP Pair-Setup, X25519/HKDF/ChaCha20-Poly1305 Pair-Verify, or
+//! encrypted HAP framing, so Apple Home pairing is deliberately unavailable.
 //!
 //! # Module layout
 //!
@@ -16,7 +16,11 @@
 //! | [`mapping`] | `EntityToAccessoryMapper` — HOMECORE entity → HAP |
 //! | [`bridge`] | `HapBridge` — owns exposed accessories |
 //! | [`mdns`] | `MdnsAdvertiser` trait + `NullAdvertiser` stub |
+//! | [`pairing`] | Atomic controller pairing persistence |
+//! | [`protocol`] | Bounded TLV8 protocol primitives |
 //! | [`ruview`] | `RuViewToHapMapper` — sensing primitives → HAP |
+//! | [`session`] | Authenticated request-gating state machine |
+//! | `server` | Feature-gated bounded TCP/HTTP lifecycle |
 //! | [`error`] | Unified `HapError` type |
 
 pub mod accessory;
@@ -24,11 +28,22 @@ pub mod bridge;
 pub mod error;
 pub mod mapping;
 pub mod mdns;
+pub mod pairing;
+pub mod protocol;
 pub mod ruview;
+#[cfg(feature = "hap-server")]
+pub mod server;
+pub mod session;
 
 pub use accessory::{HapAccessoryType, HapCharacteristic, HapCharacteristicValue};
-pub use bridge::{ExposedAccessory, HapBridge};
+pub use bridge::{CharacteristicEvent, ExposedAccessory, HapBridge};
 pub use error::HapError;
 pub use mapping::EntityToAccessoryMapper;
-pub use mdns::{MdnsAdvertiser, NullAdvertiser};
+#[cfg(feature = "hap-server")]
+pub use mdns::MdnsSdAdvertiser;
+pub use mdns::{HapServiceRecord, MdnsAdvertiser, NullAdvertiser};
+pub use pairing::{ControllerPairing, PairingStore};
 pub use ruview::RuViewToHapMapper;
+#[cfg(feature = "hap-server")]
+pub use server::{start_server, HapServerConfig, HapServerHandle};
+pub use session::{Session, SessionState};
diff --git a/v2/crates/homecore-hap/src/mdns.rs b/v2/crates/homecore-hap/src/mdns.rs
index ada1bed3..183a4743 100644
--- a/v2/crates/homecore-hap/src/mdns.rs
+++ b/v2/crates/homecore-hap/src/mdns.rs
@@ -1,61 +1,206 @@
-//! mDNS advertisement trait and P1 no-op stub.
-//!
-//! Real mDNS via the `mdns-sd` crate (https://crates.io/crates/mdns-sd)
-//! lands in P2 behind the `hap-server` feature flag. P1 ships `NullAdvertiser`
-//! so the bridge compiles and tests pass without any mDNS infrastructure.
+//! HAP `_hap._tcp` advertisement.
 
 use async_trait::async_trait;
 
 use crate::error::HapError;
 
-/// Service record advertised over mDNS for HAP discovery.
-#[derive(Debug, Clone)]
+/// HAP service record advertised over mDNS.
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct HapServiceRecord {
-    /// Service instance name shown in Apple Home ("RuView Sense").
+    /// Service instance shown in discovery UI.
     pub instance_name: String,
-    /// TCP port the HAP server listens on (default 51826).
+    /// Bound HAP TCP port.
     pub port: u16,
-    /// HAP pairing setup code (8 digits, formatted as XXX-XX-XXX).
-    pub setup_code: String,
-    /// Unique device ID (colon-separated MAC-like hex, required by HAP §5.4).
+    /// Stable colon-separated accessory device identifier.
     pub device_id: String,
+    /// Accessory model (`md` TXT key).
+    pub model: String,
+    /// Configuration number (`c#`), incremented when accessory layout changes.
+    pub configuration_number: u32,
+    /// Current state number (`s#`).
+    pub state_number: u32,
+    /// HAP accessory category identifier. Bridges use `2`.
+    pub category: u16,
+    /// Whether a controller pairing already exists.
+    pub paired: bool,
 }
 
-/// Advertise (and retract) a HAP accessory over mDNS (`_hap._tcp`).
-///
-/// Implementors register the `_hap._tcp` service so HomePod / Apple TV can
-/// discover the bridge and initiate pairing. P1 provides only `NullAdvertiser`.
+impl HapServiceRecord {
+    pub fn bridge(
+        instance_name: impl Into<String>,
+        port: u16,
+        device_id: impl Into<String>,
+    ) -> Self {
+        Self {
+            instance_name: instance_name.into(),
+            port,
+            device_id: device_id.into(),
+            model: "HOMECORE Bridge".into(),
+            configuration_number: 1,
+            state_number: 1,
+            category: 2,
+            paired: false,
+        }
+    }
+
+    fn validate(&self) -> Result<(), HapError> {
+        if self.instance_name.is_empty() || self.instance_name.len() > 63 {
+            return Err(HapError::MdnsError(
+                "instance_name must contain 1..=63 bytes".into(),
+            ));
+        }
+        if self.port == 0 {
+            return Err(HapError::MdnsError("advertised port cannot be zero".into()));
+        }
+        let parts: Vec<&str> = self.device_id.split(':').collect();
+        if parts.len() != 6
+            || parts
+                .iter()
+                .any(|part| part.len() != 2 || !part.bytes().all(|byte| byte.is_ascii_hexdigit()))
+        {
+            return Err(HapError::MdnsError(
+                "device_id must be six colon-separated hexadecimal octets".into(),
+            ));
+        }
+        if self.model.is_empty() || self.model.len() > 64 {
+            return Err(HapError::MdnsError(
+                "model must contain 1..=64 bytes".into(),
+            ));
+        }
+        if self.configuration_number == 0 || self.state_number == 0 {
+            return Err(HapError::MdnsError(
+                "configuration and state numbers must be non-zero".into(),
+            ));
+        }
+        Ok(())
+    }
+
+    /// Standard HAP Bonjour TXT keys. Setup codes and controller data are
+    /// intentionally never included because TXT records are plaintext.
+    pub fn txt_records(&self) -> Vec<(String, String)> {
+        vec![
+            ("c#".into(), self.configuration_number.to_string()),
+            ("ci".into(), self.category.to_string()),
+            ("ff".into(), "0".into()),
+            ("id".into(), self.device_id.to_ascii_uppercase()),
+            ("md".into(), self.model.clone()),
+            ("pv".into(), "1.1".into()),
+            ("s#".into(), self.state_number.to_string()),
+            ("sf".into(), if self.paired { "0" } else { "1" }.into()),
+        ]
+    }
+}
+
+/// Advertise and retract a HAP service.
 #[async_trait]
 pub trait MdnsAdvertiser: Send + Sync {
-    /// Begin advertising the service. Idempotent.
     async fn advertise(&self, record: &HapServiceRecord) -> Result<(), HapError>;
-
-    /// Stop advertising. Called on bridge shutdown.
     async fn retract(&self, instance_name: &str) -> Result<(), HapError>;
 }
 
-/// No-op advertiser for P1 / test environments.
-///
-/// All calls succeed without touching the network.
+/// Deterministic no-network advertiser for tests and disabled deployments.
 #[derive(Debug, Default, Clone)]
 pub struct NullAdvertiser;
 
 #[async_trait]
 impl MdnsAdvertiser for NullAdvertiser {
     async fn advertise(&self, record: &HapServiceRecord) -> Result<(), HapError> {
+        record.validate()?;
         tracing::debug!(
             instance = %record.instance_name,
             port = record.port,
-            "NullAdvertiser: skipping mDNS advertisement (P1 stub)"
+            "HAP mDNS advertisement disabled"
         );
         Ok(())
     }
 
     async fn retract(&self, instance_name: &str) -> Result<(), HapError> {
-        tracing::debug!(
-            instance = %instance_name,
-            "NullAdvertiser: skipping mDNS retract (P1 stub)"
-        );
+        tracing::debug!(instance = %instance_name, "HAP mDNS retraction disabled");
+        Ok(())
+    }
+}
+
+/// Network-backed Bonjour advertiser.
+#[cfg(feature = "hap-server")]
+pub struct MdnsSdAdvertiser {
+    daemon: mdns_sd::ServiceDaemon,
+    hostname: String,
+    address: String,
+    registrations: std::sync::Mutex<std::collections::HashMap<String, String>>,
+}
+
+#[cfg(feature = "hap-server")]
+impl std::fmt::Debug for MdnsSdAdvertiser {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("MdnsSdAdvertiser")
+            .field("hostname", &self.hostname)
+            .field("address", &self.address)
+            .finish_non_exhaustive()
+    }
+}
+
+#[cfg(feature = "hap-server")]
+impl MdnsSdAdvertiser {
+    /// Bind the mDNS daemon for a LAN-routable host/address.
+    pub fn new(hostname: impl Into<String>, address: std::net::IpAddr) -> Result<Self, HapError> {
+        let mut hostname = hostname.into();
+        if !hostname.ends_with(".local.") {
+            hostname = format!("{}.local.", hostname.trim_end_matches('.'));
+        }
+        let daemon = mdns_sd::ServiceDaemon::new()
+            .map_err(|error| HapError::MdnsError(error.to_string()))?;
+        Ok(Self {
+            daemon,
+            hostname,
+            address: address.to_string(),
+            registrations: std::sync::Mutex::new(std::collections::HashMap::new()),
+        })
+    }
+
+    fn service_info(&self, record: &HapServiceRecord) -> Result<mdns_sd::ServiceInfo, HapError> {
+        record.validate()?;
+        let properties: std::collections::HashMap<String, String> =
+            record.txt_records().into_iter().collect();
+        mdns_sd::ServiceInfo::new(
+            "_hap._tcp.local.",
+            &record.instance_name,
+            &self.hostname,
+            self.address.as_str(),
+            record.port,
+            Some(properties),
+        )
+        .map_err(|error| HapError::MdnsError(error.to_string()))
+    }
+}
+
+#[cfg(feature = "hap-server")]
+#[async_trait]
+impl MdnsAdvertiser for MdnsSdAdvertiser {
+    async fn advertise(&self, record: &HapServiceRecord) -> Result<(), HapError> {
+        let info = self.service_info(record)?;
+        let fullname = info.get_fullname().to_owned();
+        self.daemon
+            .register(info)
+            .map_err(|error| HapError::MdnsError(error.to_string()))?;
+        self.registrations
+            .lock()
+            .map_err(|_| HapError::MdnsError("registration lock poisoned".into()))?
+            .insert(record.instance_name.clone(), fullname);
+        Ok(())
+    }
+
+    async fn retract(&self, instance_name: &str) -> Result<(), HapError> {
+        let fullname = self
+            .registrations
+            .lock()
+            .map_err(|_| HapError::MdnsError("registration lock poisoned".into()))?
+            .remove(instance_name);
+        if let Some(fullname) = fullname {
+            self.daemon
+                .unregister(&fullname)
+                .map_err(|error| HapError::MdnsError(error.to_string()))?;
+        }
         Ok(())
     }
 }
@@ -64,16 +209,28 @@ impl MdnsAdvertiser for NullAdvertiser {
 mod tests {
     use super::*;
 
+    #[test]
+    fn txt_record_is_hap_shaped_and_contains_no_setup_secret() {
+        let record = HapServiceRecord::bridge("RuView Sense", 51826, "AA:BB:CC:DD:EE:FF");
+        let txt: std::collections::HashMap<_, _> = record.txt_records().into_iter().collect();
+        assert_eq!(txt.get("pv").map(String::as_str), Some("1.1"));
+        assert_eq!(txt.get("sf").map(String::as_str), Some("1"));
+        assert_eq!(txt.get("ci").map(String::as_str), Some("2"));
+        assert!(!txt
+            .keys()
+            .any(|key| key.contains("pin") || key.contains("code")));
+    }
+
     #[tokio::test]
-    async fn null_advertiser_is_noop() {
-        let adv = NullAdvertiser;
-        let rec = HapServiceRecord {
-            instance_name: "RuView Sense".into(),
-            port: 51826,
-            setup_code: "111-22-333".into(),
-            device_id: "AA:BB:CC:DD:EE:FF".into(),
-        };
-        adv.advertise(&rec).await.unwrap();
-        adv.retract(&rec.instance_name).await.unwrap();
+    async fn null_advertiser_validates_without_network_io() {
+        let record = HapServiceRecord::bridge("RuView Sense", 51826, "AA:BB:CC:DD:EE:FF");
+        NullAdvertiser.advertise(&record).await.unwrap();
+        NullAdvertiser.retract(&record.instance_name).await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn malformed_record_is_rejected() {
+        let record = HapServiceRecord::bridge("RuView Sense", 0, "not-an-id");
+        assert!(NullAdvertiser.advertise(&record).await.is_err());
     }
 }
diff --git a/v2/crates/homecore-hap/src/pairing.rs b/v2/crates/homecore-hap/src/pairing.rs
new file mode 100644
index 00000000..b2d81478
--- /dev/null
+++ b/v2/crates/homecore-hap/src/pairing.rs
@@ -0,0 +1,366 @@
+//! Durable controller pairing records.
+//!
+//! This module persists only long-term controller identities and Ed25519 public
+//! keys. It does not implement HAP Pair-Setup or Pair-Verify. Those protocol
+//! phases must populate this store only after their cryptographic transcript
+//! has been authenticated.
+
+use std::collections::BTreeMap;
+use std::fs::{self, File};
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+use std::sync::RwLock;
+
+use ed25519_dalek::VerifyingKey;
+use serde::{Deserialize, Serialize};
+use tempfile::Builder;
+
+use crate::error::HapError;
+
+const STORE_VERSION: u32 = 1;
+const MAX_STORE_BYTES: u64 = 1024 * 1024;
+const MAX_CONTROLLER_ID_BYTES: usize = 64;
+
+/// A controller authorized by a completed HAP pairing ceremony.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ControllerPairing {
+    /// HAP controller pairing identifier.
+    pub controller_id: String,
+    /// Controller Ed25519 long-term public key.
+    pub public_key: [u8; 32],
+    /// Whether this controller may manage other pairings.
+    pub admin: bool,
+}
+
+impl ControllerPairing {
+    /// Validate bounded identifiers and the encoded Ed25519 point.
+    pub fn validate(&self) -> Result<(), HapError> {
+        let len = self.controller_id.len();
+        if len == 0
+            || len > MAX_CONTROLLER_ID_BYTES
+            || self.controller_id.chars().any(char::is_control)
+        {
+            return Err(HapError::InvalidPairingRecord(
+                "controller_id must contain 1..=64 bytes and no control characters".into(),
+            ));
+        }
+        VerifyingKey::from_bytes(&self.public_key).map_err(|_| {
+            HapError::InvalidPairingRecord("controller public key is not valid Ed25519".into())
+        })?;
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct PairingFile {
+    version: u32,
+    controllers: Vec<ControllerPairing>,
+}
+
+/// Thread-safe, atomically persisted controller pairing store.
+#[derive(Debug)]
+pub struct PairingStore {
+    path: PathBuf,
+    controllers: RwLock<BTreeMap<String, ControllerPairing>>,
+}
+
+impl PairingStore {
+    /// Open an existing store or create an empty in-memory store.
+    ///
+    /// Existing files with group/other permission bits on Unix are rejected
+    /// instead of silently accepting exposed controller keys.
+    pub fn open(path: impl Into<PathBuf>) -> Result<Self, HapError> {
+        let path = path.into();
+        let controllers = if path.exists() {
+            load_file(&path)?
+        } else {
+            BTreeMap::new()
+        };
+        Ok(Self {
+            path,
+            controllers: RwLock::new(controllers),
+        })
+    }
+
+    /// Path used for durable records.
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    /// Return a deterministic snapshot ordered by controller identifier.
+    pub fn list(&self) -> Result<Vec<ControllerPairing>, HapError> {
+        Ok(self
+            .controllers
+            .read()
+            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?
+            .values()
+            .cloned()
+            .collect())
+    }
+
+    /// Look up one controller.
+    pub fn get(&self, controller_id: &str) -> Result<Option<ControllerPairing>, HapError> {
+        Ok(self
+            .controllers
+            .read()
+            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?
+            .get(controller_id)
+            .cloned())
+    }
+
+    /// Whether at least one controller has completed pairing.
+    pub fn is_paired(&self) -> Result<bool, HapError> {
+        Ok(!self
+            .controllers
+            .read()
+            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?
+            .is_empty())
+    }
+
+    /// Add a controller and durably commit it before exposing it in memory.
+    pub fn add(&self, pairing: ControllerPairing) -> Result<(), HapError> {
+        pairing.validate()?;
+        let mut guard = self
+            .controllers
+            .write()
+            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?;
+        if guard.contains_key(&pairing.controller_id) {
+            return Err(HapError::PairingAlreadyExists(pairing.controller_id));
+        }
+        let mut next = guard.clone();
+        next.insert(pairing.controller_id.clone(), pairing);
+        persist_file(&self.path, &next)?;
+        *guard = next;
+        Ok(())
+    }
+
+    /// Remove a controller, refusing to orphan remaining non-admin pairings.
+    pub fn remove(&self, controller_id: &str) -> Result<(), HapError> {
+        let mut guard = self
+            .controllers
+            .write()
+            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?;
+        if !guard.contains_key(controller_id) {
+            return Err(HapError::PairingNotFound(controller_id.to_owned()));
+        }
+        let mut next = guard.clone();
+        next.remove(controller_id);
+        if !next.is_empty() && !next.values().any(|pairing| pairing.admin) {
+            return Err(HapError::InvalidPairingRecord(
+                "cannot remove the last administrator while pairings remain".into(),
+            ));
+        }
+        persist_file(&self.path, &next)?;
+        *guard = next;
+        Ok(())
+    }
+}
+
+fn load_file(path: &Path) -> Result<BTreeMap<String, ControllerPairing>, HapError> {
+    let metadata = fs::symlink_metadata(path)
+        .map_err(|error| HapError::PairingStore(format!("metadata {}: {error}", path.display())))?;
+    if metadata.file_type().is_symlink() || !metadata.is_file() {
+        return Err(HapError::PairingStore(format!(
+            "{} must be a regular, non-symlink file",
+            path.display()
+        )));
+    }
+    if metadata.len() > MAX_STORE_BYTES {
+        return Err(HapError::PairingStore(format!(
+            "{} exceeds the {MAX_STORE_BYTES}-byte limit",
+            path.display()
+        )));
+    }
+    validate_permissions(path, &metadata)?;
+
+    let mut bytes = Vec::with_capacity(metadata.len() as usize);
+    File::open(path)
+        .and_then(|file| file.take(MAX_STORE_BYTES + 1).read_to_end(&mut bytes))
+        .map_err(|error| HapError::PairingStore(format!("read {}: {error}", path.display())))?;
+    if bytes.len() as u64 > MAX_STORE_BYTES {
+        return Err(HapError::PairingStore(
+            "pairing store exceeds size limit".into(),
+        ));
+    }
+    let file: PairingFile = serde_json::from_slice(&bytes)
+        .map_err(|error| HapError::PairingStore(format!("parse {}: {error}", path.display())))?;
+    if file.version != STORE_VERSION {
+        return Err(HapError::PairingStore(format!(
+            "unsupported pairing store version {}",
+            file.version
+        )));
+    }
+
+    let mut controllers = BTreeMap::new();
+    for pairing in file.controllers {
+        pairing.validate()?;
+        let id = pairing.controller_id.clone();
+        if controllers.insert(id.clone(), pairing).is_some() {
+            return Err(HapError::InvalidPairingRecord(format!(
+                "duplicate controller_id {id}"
+            )));
+        }
+    }
+    if !controllers.is_empty() && !controllers.values().any(|pairing| pairing.admin) {
+        return Err(HapError::InvalidPairingRecord(
+            "persisted pairings have no administrator".into(),
+        ));
+    }
+    Ok(controllers)
+}
+
+fn persist_file(
+    path: &Path,
+    controllers: &BTreeMap<String, ControllerPairing>,
+) -> Result<(), HapError> {
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or(Path::new("."));
+    create_private_dir(parent)?;
+    let payload = serde_json::to_vec_pretty(&PairingFile {
+        version: STORE_VERSION,
+        controllers: controllers.values().cloned().collect(),
+    })
+    .map_err(|error| HapError::PairingStore(format!("serialize pairings: {error}")))?;
+
+    let mut temp = Builder::new()
+        .prefix(".homecore-hap-pairings-")
+        .tempfile_in(parent)
+        .map_err(|error| HapError::PairingStore(format!("create temporary store: {error}")))?;
+    set_private_file_permissions(temp.as_file())?;
+    temp.write_all(&payload)
+        .and_then(|_| temp.flush())
+        .and_then(|_| temp.as_file().sync_all())
+        .map_err(|error| HapError::PairingStore(format!("write temporary store: {error}")))?;
+    temp.persist(path).map_err(|error| {
+        HapError::PairingStore(format!("replace {}: {}", path.display(), error.error))
+    })?;
+
+    #[cfg(unix)]
+    {
+        File::open(parent)
+            .and_then(|directory| directory.sync_all())
+            .map_err(|error| {
+                HapError::PairingStore(format!("sync {}: {error}", parent.display()))
+            })?;
+    }
+    Ok(())
+}
+
+fn create_private_dir(path: &Path) -> Result<(), HapError> {
+    let created = !path.exists();
+    if created {
+        fs::create_dir_all(path).map_err(|error| {
+            HapError::PairingStore(format!("create {}: {error}", path.display()))
+        })?;
+    }
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        if created {
+            fs::set_permissions(path, fs::Permissions::from_mode(0o700)).map_err(|error| {
+                HapError::PairingStore(format!("chmod {}: {error}", path.display()))
+            })?;
+        }
+    }
+    Ok(())
+}
+
+fn set_private_file_permissions(_file: &File) -> Result<(), HapError> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        _file
+            .set_permissions(fs::Permissions::from_mode(0o600))
+            .map_err(|error| HapError::PairingStore(format!("chmod temporary store: {error}")))?;
+    }
+    Ok(())
+}
+
+fn validate_permissions(path: &Path, metadata: &fs::Metadata) -> Result<(), HapError> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mode = metadata.permissions().mode();
+        if mode & 0o077 != 0 {
+            return Err(HapError::InsecurePermissions {
+                path: path.to_path_buf(),
+                mode: mode & 0o777,
+            });
+        }
+    }
+    let _ = (path, metadata);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ed25519_dalek::SigningKey;
+
+    fn pairing(id: &str, byte: u8, admin: bool) -> ControllerPairing {
+        let public_key = SigningKey::from_bytes(&[byte; 32])
+            .verifying_key()
+            .to_bytes();
+        ControllerPairing {
+            controller_id: id.into(),
+            public_key,
+            admin,
+        }
+    }
+
+    #[test]
+    fn restart_loads_atomically_persisted_pairings() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("pairings.json");
+        let store = PairingStore::open(&path).unwrap();
+        store.add(pairing("controller-1", 7, true)).unwrap();
+        drop(store);
+
+        let reopened = PairingStore::open(&path).unwrap();
+        assert_eq!(
+            reopened.list().unwrap(),
+            vec![pairing("controller-1", 7, true)]
+        );
+    }
+
+    #[test]
+    fn malformed_and_duplicate_records_fail_closed() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("pairings.json");
+        fs::write(&path, br#"{"version":1,"controllers":[{"controller_id":"","public_key":[0,1],"admin":true}]}"#).unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).unwrap();
+        }
+        assert!(PairingStore::open(path).is_err());
+    }
+
+    #[test]
+    fn cannot_remove_last_admin_while_members_remain() {
+        let directory = tempfile::tempdir().unwrap();
+        let store = PairingStore::open(directory.path().join("pairings.json")).unwrap();
+        store.add(pairing("admin", 1, true)).unwrap();
+        store.add(pairing("member", 2, false)).unwrap();
+        assert!(store.remove("admin").is_err());
+        assert_eq!(store.list().unwrap().len(), 2);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn permissive_existing_file_is_rejected() {
+        use std::os::unix::fs::PermissionsExt;
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("pairings.json");
+        fs::write(&path, br#"{"version":1,"controllers":[]}"#).unwrap();
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o644)).unwrap();
+        assert!(matches!(
+            PairingStore::open(path),
+            Err(HapError::InsecurePermissions { .. })
+        ));
+    }
+}
diff --git a/v2/crates/homecore-hap/src/protocol.rs b/v2/crates/homecore-hap/src/protocol.rs
new file mode 100644
index 00000000..53cdbb8c
--- /dev/null
+++ b/v2/crates/homecore-hap/src/protocol.rs
@@ -0,0 +1,129 @@
+//! Bounded HAP TLV8 primitives and fail-closed pairing responses.
+
+use std::collections::BTreeMap;
+
+use crate::error::HapError;
+
+pub const TLV_METHOD: u8 = 0x00;
+pub const TLV_IDENTIFIER: u8 = 0x01;
+pub const TLV_PUBLIC_KEY: u8 = 0x03;
+pub const TLV_STATE: u8 = 0x06;
+pub const TLV_ERROR: u8 = 0x07;
+pub const TLV_SIGNATURE: u8 = 0x0a;
+
+pub const TLV_ERROR_AUTHENTICATION: u8 = 0x02;
+pub const TLV_ERROR_UNAVAILABLE: u8 = 0x06;
+pub const TLV_ERROR_BUSY: u8 = 0x07;
+
+const MAX_TLV_BYTES: usize = 4096;
+const MAX_TLV_TYPES: usize = 32;
+
+/// Parsed TLV8 values. Repeated fragments of a type are concatenated.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct Tlv8 {
+    values: BTreeMap<u8, Vec<u8>>,
+}
+
+impl Tlv8 {
+    pub fn parse(input: &[u8]) -> Result<Self, HapError> {
+        if input.len() > MAX_TLV_BYTES {
+            return Err(HapError::Protocol("TLV8 body exceeds 4096 bytes".into()));
+        }
+        let mut values: BTreeMap<u8, Vec<u8>> = BTreeMap::new();
+        let mut offset = 0usize;
+        while offset < input.len() {
+            if input.len() - offset < 2 {
+                return Err(HapError::Protocol("truncated TLV8 header".into()));
+            }
+            let kind = input[offset];
+            let len = input[offset + 1] as usize;
+            offset += 2;
+            let end = offset
+                .checked_add(len)
+                .filter(|end| *end <= input.len())
+                .ok_or_else(|| HapError::Protocol("truncated TLV8 value".into()))?;
+            if !values.contains_key(&kind) && values.len() == MAX_TLV_TYPES {
+                return Err(HapError::Protocol("too many TLV8 types".into()));
+            }
+            values
+                .entry(kind)
+                .or_default()
+                .extend_from_slice(&input[offset..end]);
+            offset = end;
+        }
+        Ok(Self { values })
+    }
+
+    pub fn get(&self, kind: u8) -> Option<&[u8]> {
+        self.values.get(&kind).map(Vec::as_slice)
+    }
+
+    pub fn byte(&self, kind: u8) -> Option<u8> {
+        let value = self.get(kind)?;
+        (value.len() == 1).then_some(value[0])
+    }
+
+    pub fn insert(&mut self, kind: u8, value: impl Into<Vec<u8>>) {
+        self.values.insert(kind, value.into());
+    }
+
+    pub fn encode(&self) -> Vec<u8> {
+        let mut encoded = Vec::new();
+        for (&kind, value) in &self.values {
+            if value.is_empty() {
+                encoded.extend_from_slice(&[kind, 0]);
+                continue;
+            }
+            for chunk in value.chunks(u8::MAX as usize) {
+                encoded.push(kind);
+                encoded.push(chunk.len() as u8);
+                encoded.extend_from_slice(chunk);
+            }
+        }
+        encoded
+    }
+}
+
+/// Standards-shaped response used while cryptographic pairing phases are
+/// unavailable. It is a real TLV8 error, never a success-shaped placeholder.
+pub fn pairing_unavailable_response(request: &[u8]) -> Result<Vec<u8>, HapError> {
+    let request = Tlv8::parse(request)?;
+    let request_state = request
+        .byte(TLV_STATE)
+        .ok_or_else(|| HapError::Protocol("pairing request lacks one-byte State".into()))?;
+    let response_state = request_state.saturating_add(1);
+    let mut response = Tlv8::default();
+    response.insert(TLV_STATE, vec![response_state]);
+    response.insert(TLV_ERROR, vec![TLV_ERROR_UNAVAILABLE]);
+    Ok(response.encode())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tlv8_roundtrip_supports_fragmented_values() {
+        let mut tlv = Tlv8::default();
+        tlv.insert(TLV_PUBLIC_KEY, vec![3; 300]);
+        tlv.insert(TLV_STATE, vec![1]);
+        let encoded = tlv.encode();
+        let decoded = Tlv8::parse(&encoded).unwrap();
+        assert_eq!(decoded, tlv);
+    }
+
+    #[test]
+    fn malformed_or_oversized_tlv_is_rejected() {
+        assert!(Tlv8::parse(&[TLV_STATE]).is_err());
+        assert!(Tlv8::parse(&[TLV_STATE, 2, 1]).is_err());
+        assert!(Tlv8::parse(&vec![0; MAX_TLV_BYTES + 1]).is_err());
+    }
+
+    #[test]
+    fn unavailable_pairing_is_an_explicit_error_not_success() {
+        let response = pairing_unavailable_response(&[TLV_STATE, 1, 1]).unwrap();
+        let decoded = Tlv8::parse(&response).unwrap();
+        assert_eq!(decoded.byte(TLV_STATE), Some(2));
+        assert_eq!(decoded.byte(TLV_ERROR), Some(TLV_ERROR_UNAVAILABLE));
+    }
+}
diff --git a/v2/crates/homecore-hap/src/server.rs b/v2/crates/homecore-hap/src/server.rs
new file mode 100644
index 00000000..cf4ae018
--- /dev/null
+++ b/v2/crates/homecore-hap/src/server.rs
@@ -0,0 +1,911 @@
+//! Bounded async TCP/HTTP foundation for HAP.
+//!
+//! The listener parses plaintext pairing HTTP and has authenticated accessory
+//! endpoint handlers ready for a future encrypted transport. Because Pair-
+//! Setup, Pair-Verify, and HAP frame encryption are not complete, no network
+//! request can currently transition a session to authenticated.
+
+use std::collections::HashSet;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use std::time::Duration;
+
+use httparse::Status;
+use serde_json::{json, Value};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::{TcpListener, TcpStream};
+use tokio::sync::{oneshot, Semaphore};
+use tokio::task::{JoinHandle, JoinSet};
+use tokio::time::{timeout, Instant};
+
+use crate::accessory::{HapAccessoryType, HapCharacteristic, HapCharacteristicValue};
+use crate::bridge::{CharacteristicEvent, ExposedAccessory, HapBridge};
+use crate::error::HapError;
+use crate::mdns::MdnsAdvertiser;
+use crate::pairing::PairingStore;
+use crate::protocol::pairing_unavailable_response;
+use crate::session::Session;
+
+const HAP_JSON: &str = "application/hap+json";
+const HAP_TLV: &str = "application/pairing+tlv8";
+
+/// Resource bounds for the HAP listener.
+#[derive(Debug, Clone)]
+pub struct HapServerConfig {
+    pub bind_addr: SocketAddr,
+    pub max_connections: usize,
+    pub max_header_bytes: usize,
+    pub max_body_bytes: usize,
+    pub request_timeout: Duration,
+    pub shutdown_timeout: Duration,
+}
+
+impl Default for HapServerConfig {
+    fn default() -> Self {
+        Self {
+            bind_addr: SocketAddr::from(([0, 0, 0, 0], 51826)),
+            max_connections: 32,
+            max_header_bytes: 16 * 1024,
+            max_body_bytes: 64 * 1024,
+            request_timeout: Duration::from_secs(10),
+            shutdown_timeout: Duration::from_secs(5),
+        }
+    }
+}
+
+impl HapServerConfig {
+    fn validate(&self) -> Result<(), HapError> {
+        if self.max_connections == 0
+            || self.max_header_bytes < 512
+            || self.max_body_bytes == 0
+            || self.request_timeout.is_zero()
+            || self.shutdown_timeout.is_zero()
+        {
+            return Err(HapError::Server(
+                "invalid zero or undersized server limit".into(),
+            ));
+        }
+        Ok(())
+    }
+}
+
+/// Running server handle. Dropping it aborts the listener; [`shutdown`] also
+/// retracts mDNS and waits for connection tasks within the configured bound.
+pub struct HapServerHandle {
+    local_addr: SocketAddr,
+    shutdown: Option<oneshot::Sender<()>>,
+    task: Option<JoinHandle<Result<(), HapError>>>,
+    shutdown_timeout: Duration,
+}
+
+impl HapServerHandle {
+    pub fn local_addr(&self) -> SocketAddr {
+        self.local_addr
+    }
+
+    pub async fn shutdown(mut self) -> Result<(), HapError> {
+        if let Some(shutdown) = self.shutdown.take() {
+            let _ = shutdown.send(());
+        }
+        let Some(mut task) = self.task.take() else {
+            return Ok(());
+        };
+        match timeout(self.shutdown_timeout, &mut task).await {
+            Ok(result) => {
+                result.map_err(|error| HapError::Server(format!("server task failed: {error}")))?
+            }
+            Err(_) => {
+                task.abort();
+                let _ = task.await;
+                Err(HapError::Server(
+                    "server shutdown timed out; task aborted".into(),
+                ))
+            }
+        }
+    }
+}
+
+impl Drop for HapServerHandle {
+    fn drop(&mut self) {
+        if let Some(shutdown) = self.shutdown.take() {
+            let _ = shutdown.send(());
+        }
+        if let Some(task) = &self.task {
+            task.abort();
+        }
+    }
+}
+
+/// Start the bounded listener and advertise the actual bound port.
+pub async fn start_server(
+    config: HapServerConfig,
+    bridge: HapBridge,
+    pairings: Arc<PairingStore>,
+    advertiser: Arc<dyn MdnsAdvertiser>,
+) -> Result<HapServerHandle, HapError> {
+    config.validate()?;
+    let listener = TcpListener::bind(config.bind_addr)
+        .await
+        .map_err(|error| HapError::Server(format!("bind {}: {error}", config.bind_addr)))?;
+    let local_addr = listener
+        .local_addr()
+        .map_err(|error| HapError::Server(format!("read local address: {error}")))?;
+
+    let mut record = bridge.service_record.clone();
+    record.port = local_addr.port();
+    record.paired = pairings.is_paired()?;
+    advertiser.advertise(&record).await?;
+
+    let (shutdown_tx, shutdown_rx) = oneshot::channel();
+    let task_config = config.clone();
+    let task = tokio::spawn(run_listener(
+        listener,
+        task_config,
+        bridge,
+        pairings,
+        advertiser,
+        record.instance_name,
+        shutdown_rx,
+    ));
+    Ok(HapServerHandle {
+        local_addr,
+        shutdown: Some(shutdown_tx),
+        task: Some(task),
+        // The listener owns the configured drain window; the handle allows a
+        // small scheduling/retraction margin before enforcing its outer abort.
+        shutdown_timeout: config
+            .shutdown_timeout
+            .saturating_add(Duration::from_secs(1)),
+    })
+}
+
+async fn run_listener(
+    listener: TcpListener,
+    config: HapServerConfig,
+    bridge: HapBridge,
+    pairings: Arc<PairingStore>,
+    advertiser: Arc<dyn MdnsAdvertiser>,
+    instance_name: String,
+    mut shutdown: oneshot::Receiver<()>,
+) -> Result<(), HapError> {
+    let permits = Arc::new(Semaphore::new(config.max_connections));
+    let mut connections = JoinSet::new();
+
+    loop {
+        let permit = tokio::select! {
+            _ = &mut shutdown => break,
+            permit = permits.clone().acquire_owned() => {
+                permit.map_err(|_| HapError::Server("connection semaphore closed".into()))?
+            }
+        };
+        let accepted = tokio::select! {
+            _ = &mut shutdown => {
+                drop(permit);
+                break;
+            }
+            accepted = listener.accept() => accepted
+        };
+        match accepted {
+            Ok((stream, peer)) => {
+                let bridge = bridge.clone();
+                let pairings = pairings.clone();
+                let limits = config.clone();
+                connections.spawn(async move {
+                    let _permit = permit;
+                    if let Err(error) =
+                        serve_connection(stream, peer, limits, bridge, pairings).await
+                    {
+                        tracing::debug!(%peer, %error, "HAP connection closed");
+                    }
+                });
+            }
+            Err(error) => {
+                tracing::warn!(%error, "HAP accept failed");
+            }
+        }
+        while connections.try_join_next().is_some() {}
+    }
+
+    drop(listener);
+    let deadline = Instant::now() + config.shutdown_timeout;
+    while !connections.is_empty() {
+        let remaining = deadline.saturating_duration_since(Instant::now());
+        if remaining.is_zero() || timeout(remaining, connections.join_next()).await.is_err() {
+            connections.abort_all();
+            while connections.join_next().await.is_some() {}
+            break;
+        }
+    }
+    advertiser.retract(&instance_name).await
+}
+
+async fn serve_connection(
+    mut stream: TcpStream,
+    _peer: SocketAddr,
+    config: HapServerConfig,
+    bridge: HapBridge,
+    pairings: Arc<PairingStore>,
+) -> Result<(), HapError> {
+    let mut buffer = ConnectionBuffer::default();
+    let mut session = Session::new();
+    let mut subscriptions = HashSet::new();
+    let mut events = bridge.subscribe_events();
+
+    loop {
+        tokio::select! {
+            request = timeout(
+                config.request_timeout,
+                read_request(&mut stream, &mut buffer, &config),
+            ) => {
+                let request = match request {
+                    Ok(Ok(Some(request))) => request,
+                    Ok(Ok(None)) => break,
+                    Ok(Err(error)) => {
+                        let response = error_response(&error);
+                        write_response(&mut stream, response).await?;
+                        break;
+                    }
+                    Err(_) => {
+                        write_response(&mut stream, Response::plain(408, b"request timeout".to_vec())).await?;
+                        break;
+                    }
+                };
+                let close = request.connection_close;
+                let response = dispatch_request(
+                    request,
+                    &mut session,
+                    &bridge,
+                    &pairings,
+                    &mut subscriptions,
+                );
+                write_response(&mut stream, response).await?;
+                if close {
+                    break;
+                }
+            }
+            event = events.recv(), if session.state().is_authenticated() && !subscriptions.is_empty() => {
+                match event {
+                    Ok(event) => {
+                        if let Some(payload) = event_payload(&bridge, &event, &subscriptions) {
+                            write_event(&mut stream, payload).await?;
+                        }
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                        // A lagged controller must resynchronize through GET /characteristics.
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+                }
+            }
+        }
+    }
+    session.close();
+    Ok(())
+}
+
+#[derive(Debug)]
+struct Request {
+    method: String,
+    target: String,
+    body: Vec<u8>,
+    connection_close: bool,
+}
+
+#[derive(Default)]
+struct ConnectionBuffer {
+    bytes: Vec<u8>,
+}
+
+async fn read_request(
+    stream: &mut TcpStream,
+    buffer: &mut ConnectionBuffer,
+    config: &HapServerConfig,
+) -> Result<Option<Request>, RequestReadError> {
+    let header_end = loop {
+        if let Some(position) = find_header_end(&buffer.bytes) {
+            break position + 4;
+        }
+        if buffer.bytes.len() >= config.max_header_bytes {
+            return Err(RequestReadError::HeadersTooLarge);
+        }
+        let mut chunk = [0u8; 2048];
+        let read = stream
+            .read(&mut chunk)
+            .await
+            .map_err(RequestReadError::Io)?;
+        if read == 0 {
+            return if buffer.bytes.is_empty() {
+                Ok(None)
+            } else {
+                Err(RequestReadError::Malformed("truncated HTTP headers"))
+            };
+        }
+        buffer.bytes.extend_from_slice(&chunk[..read]);
+    };
+    if header_end > config.max_header_bytes {
+        return Err(RequestReadError::HeadersTooLarge);
+    }
+
+    let mut headers = [httparse::EMPTY_HEADER; 32];
+    let mut parsed = httparse::Request::new(&mut headers);
+    match parsed.parse(&buffer.bytes[..header_end]) {
+        Ok(Status::Complete(_)) => {}
+        Ok(Status::Partial) => return Err(RequestReadError::Malformed("partial HTTP request")),
+        Err(error) => return Err(RequestReadError::MalformedOwned(error.to_string())),
+    }
+    if parsed.version != Some(1) {
+        return Err(RequestReadError::Malformed("HTTP/1.1 required"));
+    }
+    let method = parsed
+        .method
+        .ok_or(RequestReadError::Malformed("missing method"))?
+        .to_owned();
+    let target = parsed
+        .path
+        .ok_or(RequestReadError::Malformed("missing request target"))?
+        .to_owned();
+    if target.len() > 2048 || !target.starts_with('/') {
+        return Err(RequestReadError::Malformed("invalid request target"));
+    }
+
+    let mut content_length = None;
+    let mut connection_close = false;
+    for header in parsed.headers.iter() {
+        if header.name.eq_ignore_ascii_case("transfer-encoding") {
+            return Err(RequestReadError::Malformed(
+                "Transfer-Encoding is unsupported",
+            ));
+        }
+        if header.name.eq_ignore_ascii_case("content-length") {
+            if content_length.is_some() {
+                return Err(RequestReadError::Malformed("duplicate Content-Length"));
+            }
+            let value = std::str::from_utf8(header.value)
+                .map_err(|_| RequestReadError::Malformed("non-UTF8 Content-Length"))?;
+            content_length = Some(
+                value
+                    .parse::<usize>()
+                    .map_err(|_| RequestReadError::Malformed("invalid Content-Length"))?,
+            );
+        }
+        if header.name.eq_ignore_ascii_case("connection")
+            && header.value.eq_ignore_ascii_case(b"close")
+        {
+            connection_close = true;
+        }
+    }
+    let content_length = content_length.unwrap_or(0);
+    if content_length > config.max_body_bytes {
+        return Err(RequestReadError::BodyTooLarge);
+    }
+    let request_end = header_end
+        .checked_add(content_length)
+        .ok_or(RequestReadError::BodyTooLarge)?;
+    while buffer.bytes.len() < request_end {
+        let remaining = request_end - buffer.bytes.len();
+        let mut chunk = vec![0u8; remaining.min(8192)];
+        let read = stream
+            .read(&mut chunk)
+            .await
+            .map_err(RequestReadError::Io)?;
+        if read == 0 {
+            return Err(RequestReadError::Malformed("truncated HTTP body"));
+        }
+        buffer.bytes.extend_from_slice(&chunk[..read]);
+    }
+    let body = buffer.bytes[header_end..request_end].to_vec();
+    buffer.bytes.drain(..request_end);
+    Ok(Some(Request {
+        method,
+        target,
+        body,
+        connection_close,
+    }))
+}
+
+fn find_header_end(bytes: &[u8]) -> Option<usize> {
+    bytes.windows(4).position(|window| window == b"\r\n\r\n")
+}
+
+#[derive(Debug)]
+enum RequestReadError {
+    Io(std::io::Error),
+    Malformed(&'static str),
+    MalformedOwned(String),
+    HeadersTooLarge,
+    BodyTooLarge,
+}
+
+impl std::fmt::Display for RequestReadError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Io(error) => write!(formatter, "{error}"),
+            Self::Malformed(message) => formatter.write_str(message),
+            Self::MalformedOwned(message) => formatter.write_str(message),
+            Self::HeadersTooLarge => formatter.write_str("HTTP headers too large"),
+            Self::BodyTooLarge => formatter.write_str("HTTP body too large"),
+        }
+    }
+}
+
+fn error_response(error: &RequestReadError) -> Response {
+    match error {
+        RequestReadError::HeadersTooLarge => Response::plain(431, error.to_string().into_bytes()),
+        RequestReadError::BodyTooLarge => Response::plain(413, error.to_string().into_bytes()),
+        _ => Response::plain(400, error.to_string().into_bytes()),
+    }
+}
+
+struct Response {
+    status: u16,
+    content_type: &'static str,
+    body: Vec<u8>,
+}
+
+impl Response {
+    fn plain(status: u16, body: Vec<u8>) -> Self {
+        Self {
+            status,
+            content_type: "text/plain; charset=utf-8",
+            body,
+        }
+    }
+
+    fn json(status: u16, value: Value) -> Self {
+        Self {
+            status,
+            content_type: HAP_JSON,
+            body: serde_json::to_vec(&value).expect("JSON value serialization cannot fail"),
+        }
+    }
+}
+
+fn dispatch_request(
+    request: Request,
+    session: &mut Session,
+    bridge: &HapBridge,
+    pairings: &PairingStore,
+    subscriptions: &mut HashSet<(u64, u64)>,
+) -> Response {
+    match (
+        request.method.as_str(),
+        request.target.split('?').next().unwrap_or(""),
+    ) {
+        ("POST", "/pair-setup") => {
+            let _ = session.begin_pair_setup(pairings.is_paired().unwrap_or(true));
+            let response = pairing_unavailable_response(&request.body);
+            let _ = session.reset_pairing();
+            match response {
+                Ok(body) => Response {
+                    status: 200,
+                    content_type: HAP_TLV,
+                    body,
+                },
+                Err(error) => Response::plain(400, error.to_string().into_bytes()),
+            }
+        }
+        ("POST", "/pair-verify") => {
+            let _ = session.begin_pair_verify();
+            let response = pairing_unavailable_response(&request.body);
+            let _ = session.reset_pairing();
+            match response {
+                Ok(body) => Response {
+                    status: 200,
+                    content_type: HAP_TLV,
+                    body,
+                },
+                Err(error) => Response::plain(400, error.to_string().into_bytes()),
+            }
+        }
+        _ if !session.state().is_authenticated() => Response::json(
+            470,
+            json!({"status": -70401, "message": "Connection Authorization Required"}),
+        ),
+        ("GET", "/accessories") => Response::json(200, accessories_json(bridge)),
+        ("GET", "/characteristics") => characteristics_response(&request.target, bridge),
+        ("PUT", "/characteristics") => {
+            characteristic_subscription_response(&request.body, subscriptions)
+        }
+        ("POST", "/pairings") => Response::json(
+            501,
+            json!({"status": -70406, "message": "Pairings management awaits encrypted transport"}),
+        ),
+        _ => Response::plain(404, b"not found".to_vec()),
+    }
+}
+
+fn accessories_json(bridge: &HapBridge) -> Value {
+    let accessories = indexed_accessories(bridge);
+    let mut output = vec![json!({
+        "aid": 1,
+        "services": [accessory_information(1, "HOMECORE Bridge")]
+    })];
+    for (aid, accessory) in accessories {
+        let mut characteristics = Vec::new();
+        for (index, (kind, value)) in accessory.mapping.characteristics.iter().enumerate() {
+            characteristics.push(json!({
+                "iid": 8 + index as u64,
+                "type": characteristic_type(*kind),
+                "perms": ["pr", "ev"],
+                "format": characteristic_format(value),
+                "value": characteristic_value(value),
+            }));
+        }
+        output.push(json!({
+            "aid": aid,
+            "services": [
+                accessory_information(1, accessory.entity_id.as_str()),
+                {
+                    "iid": 7,
+                    "type": service_type(accessory.accessory_type),
+                    "primary": true,
+                    "characteristics": characteristics,
+                }
+            ]
+        }));
+    }
+    json!({ "accessories": output })
+}
+
+fn accessory_information(iid: u64, name: &str) -> Value {
+    json!({
+        "iid": iid,
+        "type": "3E",
+        "characteristics": [
+            {"iid": iid + 1, "type": "23", "perms": ["pr"], "format": "string", "value": name},
+            {"iid": iid + 2, "type": "20", "perms": ["pr"], "format": "string", "value": "HOMECORE"},
+            {"iid": iid + 3, "type": "21", "perms": ["pr"], "format": "string", "value": "HOMECORE HAP Bridge"},
+            {"iid": iid + 4, "type": "30", "perms": ["pr"], "format": "string", "value": name},
+            {"iid": iid + 5, "type": "52", "perms": ["pr"], "format": "string", "value": env!("CARGO_PKG_VERSION")}
+        ]
+    })
+}
+
+fn indexed_accessories(bridge: &HapBridge) -> Vec<(u64, ExposedAccessory)> {
+    let mut accessories = bridge.running_accessories();
+    accessories.sort_by(|left, right| left.entity_id.as_str().cmp(right.entity_id.as_str()));
+    accessories
+        .into_iter()
+        .enumerate()
+        .map(|(index, accessory)| (index as u64 + 2, accessory))
+        .collect()
+}
+
+fn characteristics_response(target: &str, bridge: &HapBridge) -> Response {
+    let Some(query) = target.split_once('?').map(|(_, query)| query) else {
+        return Response::plain(400, b"missing characteristic query".to_vec());
+    };
+    let Some(ids) = query.split('&').find_map(|part| part.strip_prefix("id=")) else {
+        return Response::plain(400, b"missing id query".to_vec());
+    };
+    if ids.len() > 4096 || ids.split(',').count() > 128 {
+        return Response::plain(400, b"characteristic query too large".to_vec());
+    }
+    let accessories = indexed_accessories(bridge);
+    let mut values = Vec::new();
+    for id in ids.split(',') {
+        let Some((aid, iid)) = parse_aid_iid(id) else {
+            return Response::plain(400, b"invalid aid.iid".to_vec());
+        };
+        let value = accessories
+            .iter()
+            .find(|(candidate, _)| *candidate == aid)
+            .and_then(|(_, accessory)| {
+                accessory
+                    .mapping
+                    .characteristics
+                    .get(iid.saturating_sub(8) as usize)
+            })
+            .map(|(_, value)| characteristic_value(value));
+        values.push(match value {
+            Some(value) => json!({"aid": aid, "iid": iid, "value": value}),
+            None => json!({"aid": aid, "iid": iid, "status": -70409}),
+        });
+    }
+    Response::json(207, json!({"characteristics": values}))
+}
+
+fn characteristic_subscription_response(
+    body: &[u8],
+    subscriptions: &mut HashSet<(u64, u64)>,
+) -> Response {
+    let Ok(value) = serde_json::from_slice::<Value>(body) else {
+        return Response::plain(400, b"invalid characteristic JSON".to_vec());
+    };
+    let Some(items) = value.get("characteristics").and_then(Value::as_array) else {
+        return Response::plain(400, b"missing characteristics array".to_vec());
+    };
+    if items.len() > 128 {
+        return Response::plain(400, b"too many characteristic writes".to_vec());
+    }
+    for item in items {
+        let (Some(aid), Some(iid), Some(enabled)) = (
+            item.get("aid").and_then(Value::as_u64),
+            item.get("iid").and_then(Value::as_u64),
+            item.get("ev").and_then(Value::as_bool),
+        ) else {
+            // Entity writes are not yet connected to HOMECORE service calls.
+            return Response::json(207, json!({"characteristics": [{"status": -70405}]}));
+        };
+        if enabled {
+            subscriptions.insert((aid, iid));
+        } else {
+            subscriptions.remove(&(aid, iid));
+        }
+    }
+    Response {
+        status: 204,
+        content_type: HAP_JSON,
+        body: Vec::new(),
+    }
+}
+
+fn event_payload(
+    bridge: &HapBridge,
+    event: &CharacteristicEvent,
+    subscriptions: &HashSet<(u64, u64)>,
+) -> Option<Vec<u8>> {
+    let (aid, _) = indexed_accessories(bridge)
+        .into_iter()
+        .find(|(_, accessory)| accessory.entity_id == event.entity_id)?;
+    let values: Vec<Value> = event
+        .characteristics
+        .iter()
+        .enumerate()
+        .filter_map(|(index, (_, value))| {
+            let iid = index as u64 + 8;
+            subscriptions
+                .contains(&(aid, iid))
+                .then(|| json!({"aid": aid, "iid": iid, "value": characteristic_value(value)}))
+        })
+        .collect();
+    (!values.is_empty())
+        .then(|| serde_json::to_vec(&json!({"characteristics": values})).expect("serialize event"))
+}
+
+fn parse_aid_iid(value: &str) -> Option<(u64, u64)> {
+    let (aid, iid) = value.split_once('.')?;
+    Some((aid.parse().ok()?, iid.parse().ok()?))
+}
+
+fn characteristic_value(value: &HapCharacteristicValue) -> Value {
+    match value {
+        HapCharacteristicValue::Bool(value) => json!(value),
+        HapCharacteristicValue::UInt8(value) => json!(value),
+        HapCharacteristicValue::Float(value) => json!(value),
+    }
+}
+
+fn characteristic_format(value: &HapCharacteristicValue) -> &'static str {
+    match value {
+        HapCharacteristicValue::Bool(_) => "bool",
+        HapCharacteristicValue::UInt8(_) => "uint8",
+        HapCharacteristicValue::Float(_) => "float",
+    }
+}
+
+fn service_type(kind: HapAccessoryType) -> &'static str {
+    match kind {
+        HapAccessoryType::Lightbulb => "43",
+        HapAccessoryType::Switch => "49",
+        HapAccessoryType::OccupancySensor => "86",
+        HapAccessoryType::MotionSensor => "85",
+        HapAccessoryType::TemperatureSensor => "8A",
+        HapAccessoryType::HumiditySensor => "82",
+        HapAccessoryType::LeakSensor => "83",
+        HapAccessoryType::ContactSensor => "80",
+        HapAccessoryType::Door => "81",
+        HapAccessoryType::Lock => "45",
+        HapAccessoryType::SecuritySystem => "7E",
+    }
+}
+
+fn characteristic_type(kind: HapCharacteristic) -> &'static str {
+    match kind {
+        HapCharacteristic::On => "25",
+        HapCharacteristic::Brightness => "8",
+        HapCharacteristic::CurrentTemperature => "11",
+        HapCharacteristic::CurrentRelativeHumidity => "10",
+        HapCharacteristic::OccupancyDetected => "71",
+        HapCharacteristic::MotionDetected => "22",
+        HapCharacteristic::LeakDetected => "70",
+        HapCharacteristic::ContactSensorState => "6A",
+        HapCharacteristic::CurrentDoorState => "E",
+        HapCharacteristic::LockCurrentState => "1D",
+        HapCharacteristic::SecuritySystemCurrentState => "66",
+    }
+}
+
+async fn write_response(stream: &mut TcpStream, response: Response) -> Result<(), HapError> {
+    let reason = match response.status {
+        200 => "OK",
+        204 => "No Content",
+        207 => "Multi-Status",
+        400 => "Bad Request",
+        404 => "Not Found",
+        408 => "Request Timeout",
+        413 => "Payload Too Large",
+        431 => "Request Header Fields Too Large",
+        470 => "Connection Authorization Required",
+        501 => "Not Implemented",
+        _ => "Error",
+    };
+    let header = format!(
+        "HTTP/1.1 {} {}\r\nContent-Type: {}\r\nContent-Length: {}\r\n\r\n",
+        response.status,
+        reason,
+        response.content_type,
+        response.body.len()
+    );
+    stream
+        .write_all(header.as_bytes())
+        .await
+        .map_err(|error| HapError::Server(format!("write response header: {error}")))?;
+    stream
+        .write_all(&response.body)
+        .await
+        .map_err(|error| HapError::Server(format!("write response body: {error}")))
+}
+
+async fn write_event(stream: &mut TcpStream, body: Vec<u8>) -> Result<(), HapError> {
+    let header = format!(
+        "EVENT/1.0 200 OK\r\nContent-Type: {HAP_JSON}\r\nContent-Length: {}\r\n\r\n",
+        body.len()
+    );
+    stream
+        .write_all(header.as_bytes())
+        .await
+        .map_err(|error| HapError::Server(format!("write event header: {error}")))?;
+    stream
+        .write_all(&body)
+        .await
+        .map_err(|error| HapError::Server(format!("write event body: {error}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::mdns::{HapServiceRecord, NullAdvertiser};
+    use homecore::entity::{EntityId, State};
+    use homecore::event::Context;
+
+    fn bridge() -> HapBridge {
+        let bridge = HapBridge::new(HapServiceRecord::bridge(
+            "RuView Sense",
+            51826,
+            "AA:BB:CC:DD:EE:FF",
+        ));
+        let entity_id = EntityId::parse("binary_sensor.room_occupancy").unwrap();
+        let state = State::new(
+            entity_id.clone(),
+            "on",
+            json!({"device_class": "occupancy"}),
+            Context::default(),
+        );
+        bridge.add_accessory(&entity_id, &state).unwrap();
+        bridge
+    }
+
+    async fn server() -> (HapServerHandle, tempfile::TempDir) {
+        let directory = tempfile::tempdir().unwrap();
+        let pairings =
+            Arc::new(PairingStore::open(directory.path().join("pairings.json")).unwrap());
+        let config = HapServerConfig {
+            bind_addr: "127.0.0.1:0".parse().unwrap(),
+            request_timeout: Duration::from_secs(1),
+            shutdown_timeout: Duration::from_secs(1),
+            ..HapServerConfig::default()
+        };
+        let handle = start_server(config, bridge(), pairings, Arc::new(NullAdvertiser))
+            .await
+            .unwrap();
+        (handle, directory)
+    }
+
+    async fn exchange(addr: SocketAddr, request: &[u8]) -> Vec<u8> {
+        let mut stream = TcpStream::connect(addr).await.unwrap();
+        stream.write_all(request).await.unwrap();
+        stream.shutdown().await.unwrap();
+        let mut response = Vec::new();
+        stream.read_to_end(&mut response).await.unwrap();
+        response
+    }
+
+    #[tokio::test]
+    async fn lifecycle_binds_and_shuts_down() {
+        let (server, _directory) = server().await;
+        assert_ne!(server.local_addr().port(), 0);
+        server.shutdown().await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn shutdown_remains_bounded_with_idle_connection() {
+        let (server, _directory) = server().await;
+        let _idle = TcpStream::connect(server.local_addr()).await.unwrap();
+        timeout(Duration::from_secs(3), server.shutdown())
+            .await
+            .expect("shutdown exceeded its outer bound")
+            .unwrap();
+    }
+
+    #[tokio::test]
+    async fn unauthenticated_accessory_request_is_gated() {
+        let (server, _directory) = server().await;
+        let response = exchange(
+            server.local_addr(),
+            b"GET /accessories HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n",
+        )
+        .await;
+        assert!(response.starts_with(b"HTTP/1.1 470"));
+        server.shutdown().await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn pairing_endpoint_returns_explicit_unavailable_tlv() {
+        let (server, _directory) = server().await;
+        let response = exchange(
+            server.local_addr(),
+            b"POST /pair-setup HTTP/1.1\r\nHost: localhost\r\nContent-Length: 3\r\nConnection: close\r\n\r\n\x06\x01\x01",
+        )
+        .await;
+        assert!(response.starts_with(b"HTTP/1.1 200"));
+        assert!(response.ends_with(b"\x06\x01\x02\x07\x01\x06"));
+        server.shutdown().await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn malformed_and_oversized_requests_are_rejected() {
+        let (server, _directory) = server().await;
+        let malformed = exchange(
+            server.local_addr(),
+            b"GET / HTTP/1.0\r\nConnection: close\r\n\r\n",
+        )
+        .await;
+        assert!(malformed.starts_with(b"HTTP/1.1 400"));
+        let oversized = exchange(
+            server.local_addr(),
+            b"POST /pair-setup HTTP/1.1\r\nContent-Length: 999999\r\nConnection: close\r\n\r\n",
+        )
+        .await;
+        assert!(oversized.starts_with(b"HTTP/1.1 413"));
+        server.shutdown().await.unwrap();
+    }
+
+    #[test]
+    fn authenticated_internal_dispatch_exposes_accessories_and_events() {
+        let bridge = bridge();
+        let directory = tempfile::tempdir().unwrap();
+        let pairings = PairingStore::open(directory.path().join("pairings.json")).unwrap();
+        let mut session = Session::authenticated_for_test(true);
+        let mut subscriptions = HashSet::new();
+        let response = dispatch_request(
+            Request {
+                method: "GET".into(),
+                target: "/accessories".into(),
+                body: Vec::new(),
+                connection_close: false,
+            },
+            &mut session,
+            &bridge,
+            &pairings,
+            &mut subscriptions,
+        );
+        assert_eq!(response.status, 200);
+        let body: Value = serde_json::from_slice(&response.body).unwrap();
+        assert_eq!(body["accessories"].as_array().unwrap().len(), 2);
+
+        let response = dispatch_request(
+            Request {
+                method: "PUT".into(),
+                target: "/characteristics".into(),
+                body: br#"{"characteristics":[{"aid":2,"iid":8,"ev":true}]}"#.to_vec(),
+                connection_close: false,
+            },
+            &mut session,
+            &bridge,
+            &pairings,
+            &mut subscriptions,
+        );
+        assert_eq!(response.status, 204);
+        assert!(subscriptions.contains(&(2, 8)));
+    }
+}
diff --git a/v2/crates/homecore-hap/src/session.rs b/v2/crates/homecore-hap/src/session.rs
new file mode 100644
index 00000000..4433d842
--- /dev/null
+++ b/v2/crates/homecore-hap/src/session.rs
@@ -0,0 +1,212 @@
+//! Per-connection HAP authentication state.
+//!
+//! The transition to [`SessionState::Authenticated`] requires an Ed25519
+//! signature from a persisted controller. The caller is responsible for
+//! supplying the exact Pair-Verify transcript once X25519/HKDF/ChaCha20-
+//! Poly1305 transport is implemented; this crate never substitutes a bearer
+//! token or plaintext shortcut.
+
+use ed25519_dalek::{Signature, Verifier, VerifyingKey};
+
+use crate::error::HapError;
+use crate::pairing::PairingStore;
+
+/// Authentication phase of one TCP connection.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SessionState {
+    Connected,
+    PairSetup,
+    PairVerify,
+    Authenticated { controller_id: String, admin: bool },
+    Closing,
+}
+
+impl SessionState {
+    fn name(&self) -> &'static str {
+        match self {
+            Self::Connected => "connected",
+            Self::PairSetup => "pair-setup",
+            Self::PairVerify => "pair-verify",
+            Self::Authenticated { .. } => "authenticated",
+            Self::Closing => "closing",
+        }
+    }
+
+    /// Whether accessory, characteristic, event, and pairing-management
+    /// endpoints may be processed.
+    pub fn is_authenticated(&self) -> bool {
+        matches!(self, Self::Authenticated { .. })
+    }
+}
+
+/// Fail-closed state machine for one HAP connection.
+#[derive(Debug, Clone)]
+pub struct Session {
+    state: SessionState,
+}
+
+impl Default for Session {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Session {
+    pub fn new() -> Self {
+        Self {
+            state: SessionState::Connected,
+        }
+    }
+
+    pub fn state(&self) -> &SessionState {
+        &self.state
+    }
+
+    pub fn begin_pair_setup(&mut self, already_paired: bool) -> Result<(), HapError> {
+        if already_paired {
+            return Err(HapError::Protocol(
+                "Pair-Setup is unavailable after a controller is paired".into(),
+            ));
+        }
+        self.transition(SessionState::PairSetup)
+    }
+
+    pub fn begin_pair_verify(&mut self) -> Result<(), HapError> {
+        self.transition(SessionState::PairVerify)
+    }
+
+    /// Authenticate a completed Pair-Verify transcript with the controller's
+    /// persisted Ed25519 long-term public key.
+    ///
+    /// This method is intentionally not called by the current network server:
+    /// the encrypted Pair-Verify transcript is not implemented yet.
+    pub fn authenticate_pair_verify(
+        &mut self,
+        controller_id: &str,
+        signed_transcript: &[u8],
+        signature: &[u8; 64],
+        pairings: &PairingStore,
+    ) -> Result<(), HapError> {
+        if !matches!(self.state, SessionState::PairVerify) {
+            return Err(HapError::InvalidSessionTransition {
+                from: self.state.name(),
+                to: "authenticated",
+            });
+        }
+        let pairing = pairings
+            .get(controller_id)?
+            .ok_or_else(|| HapError::PairingNotFound(controller_id.to_owned()))?;
+        let key = VerifyingKey::from_bytes(&pairing.public_key)
+            .map_err(|_| HapError::InvalidPairingRecord("invalid Ed25519 public key".into()))?;
+        let signature = Signature::from_bytes(signature);
+        key.verify(signed_transcript, &signature)
+            .map_err(|_| HapError::Protocol("Pair-Verify controller signature rejected".into()))?;
+        self.state = SessionState::Authenticated {
+            controller_id: pairing.controller_id,
+            admin: pairing.admin,
+        };
+        Ok(())
+    }
+
+    pub fn reset_pairing(&mut self) -> Result<(), HapError> {
+        match self.state {
+            SessionState::PairSetup | SessionState::PairVerify => {
+                self.state = SessionState::Connected;
+                Ok(())
+            }
+            _ => Err(HapError::InvalidSessionTransition {
+                from: self.state.name(),
+                to: "connected",
+            }),
+        }
+    }
+
+    pub fn close(&mut self) {
+        self.state = SessionState::Closing;
+    }
+
+    #[cfg(all(test, feature = "hap-server"))]
+    pub(crate) fn authenticated_for_test(admin: bool) -> Self {
+        Self {
+            state: SessionState::Authenticated {
+                controller_id: "test-controller".into(),
+                admin,
+            },
+        }
+    }
+
+    fn transition(&mut self, next: SessionState) -> Result<(), HapError> {
+        if matches!(self.state, SessionState::Connected) {
+            self.state = next;
+            Ok(())
+        } else {
+            Err(HapError::InvalidSessionTransition {
+                from: self.state.name(),
+                to: next.name(),
+            })
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::pairing::ControllerPairing;
+    use ed25519_dalek::{Signer, SigningKey};
+
+    #[test]
+    fn authenticated_transition_requires_persisted_valid_signature() {
+        let directory = tempfile::tempdir().unwrap();
+        let store = PairingStore::open(directory.path().join("pairings.json")).unwrap();
+        let signing_key = SigningKey::from_bytes(&[42; 32]);
+        store
+            .add(ControllerPairing {
+                controller_id: "controller".into(),
+                public_key: signing_key.verifying_key().to_bytes(),
+                admin: true,
+            })
+            .unwrap();
+
+        let transcript = b"pair-verify transcript supplied by protocol implementation";
+        let signature = signing_key.sign(transcript).to_bytes();
+        let mut session = Session::new();
+        session.begin_pair_verify().unwrap();
+        session
+            .authenticate_pair_verify("controller", transcript, &signature, &store)
+            .unwrap();
+        assert!(session.state().is_authenticated());
+    }
+
+    #[test]
+    fn bad_signature_and_skipped_verify_fail_closed() {
+        let directory = tempfile::tempdir().unwrap();
+        let store = PairingStore::open(directory.path().join("pairings.json")).unwrap();
+        let signing_key = SigningKey::from_bytes(&[9; 32]);
+        store
+            .add(ControllerPairing {
+                controller_id: "controller".into(),
+                public_key: signing_key.verifying_key().to_bytes(),
+                admin: true,
+            })
+            .unwrap();
+
+        let mut session = Session::new();
+        assert!(session
+            .authenticate_pair_verify("controller", b"x", &[0; 64], &store)
+            .is_err());
+        session.begin_pair_verify().unwrap();
+        assert!(session
+            .authenticate_pair_verify("controller", b"x", &[0; 64], &store)
+            .is_err());
+        assert!(!session.state().is_authenticated());
+    }
+
+    #[test]
+    fn pairing_phases_cannot_overlap() {
+        let mut session = Session::new();
+        session.begin_pair_setup(false).unwrap();
+        assert!(session.begin_pair_verify().is_err());
+        session.reset_pairing().unwrap();
+        session.begin_pair_verify().unwrap();
+    }
+}

From ec2c64cb62e85ea9a5c3586207b2298eda43d117 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:19:51 -0400
Subject: [PATCH 06/16] fix(homecore-server): separate HA and dashboard event
 routes

---
 v2/crates/homecore-server/src/gateway.rs         | 4 ++--
 v2/crates/homecore-server/ui/js/api.js           | 4 ++--
 v2/crates/homecore-server/ui/js/panels/events.js | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/v2/crates/homecore-server/src/gateway.rs b/v2/crates/homecore-server/src/gateway.rs
index 2f1f1816..34a0650a 100644
--- a/v2/crates/homecore-server/src/gateway.rs
+++ b/v2/crates/homecore-server/src/gateway.rs
@@ -115,7 +115,7 @@ pub fn gateway_router(state: GatewayState) -> Router {
         .route("/api/homecore/cogs/updates", get(empty_list))
         .route("/api/homecore/hailo", get(stub_503))
         .route("/api/homecore/tokens", get(stub_503))
-        .route("/api/events", get(stub_503))
+        .route("/api/homecore/events", get(stub_503))
         .with_state(state)
 }
 
@@ -728,7 +728,7 @@ mod tests {
             "/api/homecore/seeds",
             "/api/homecore/federation",
             "/api/homecore/witness",
-            "/api/events",
+            "/api/homecore/events",
         ] {
             let (status, body) = send(gateway_router(gw()), "GET", p).await;
             assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE, "{p} should be 503");
diff --git a/v2/crates/homecore-server/ui/js/api.js b/v2/crates/homecore-server/ui/js/api.js
index 5cedf3f0..70321796 100644
--- a/v2/crates/homecore-server/ui/js/api.js
+++ b/v2/crates/homecore-server/ui/js/api.js
@@ -76,7 +76,7 @@ export const api = {
   async callService(domain, service, data) { return this._post(`/api/services/${domain}/${service}`, data); },
   async setState(entityId, state, attributes) { return this._post(`/api/states/${entityId}`, { state, attributes: attributes || {} }); },
 
-  // ── gateway /api/homecore/* + /api/events (§11.2) ─────────────────
+  // ── gateway /api/homecore/* (§11.2) ───────────────────────────────
   async appliance() { return this._data('appliance', '/api/homecore/appliance', (m) => m.applianceHealth()); },
   async seeds() { return this._data('fleet', '/api/homecore/seeds', (m) => m.seeds()); },
   async seed(id) { return this._data('fleet', '/api/homecore/seeds/' + encodeURIComponent(id), (m) => m.seed(id)); },
@@ -93,7 +93,7 @@ export const api = {
   async witnessLog(page = 0, size = 12) { return this._data('audit', `/api/homecore/witness?page=${page}&size=${size}`, (m) => m.witnessLog(page, size)); },
   async privacyModes() { return this._data('audit', '/api/homecore/privacy', (m) => m.privacyModes()); },
   async setPrivacy(seed, modeValue) { if (demoMode()) return { seed, mode: modeValue }; return this._post('/api/homecore/privacy', { seed, mode: modeValue }); },
-  async eventHistory(n = 40) { return this._data('events', `/api/events?limit=${n}`, (m) => m.recentEvents(n)); },
+  async eventHistory(n = 40) { return this._data('events', `/api/homecore/events?limit=${n}`, (m) => m.recentEvents(n)); },
   recentEvents(n) { return this.eventHistory(n); }, // back-compat alias (async)
   async settings() { return this._data('settings', '/api/homecore/settings', (m) => m.settings()); },
   async automations() { return this._data('automations', '/api/homecore/automations', () => []); },
diff --git a/v2/crates/homecore-server/ui/js/panels/events.js b/v2/crates/homecore-server/ui/js/panels/events.js
index be4ffcbe..7724386d 100644
--- a/v2/crates/homecore-server/ui/js/panels/events.js
+++ b/v2/crates/homecore-server/ui/js/panels/events.js
@@ -1,6 +1,6 @@
 // §4.8 Event Bus & Automation Feed — ADR-131 / ADR-129.
 //
-// Live event stream (seeded from /api/events, then prepended live from
+// Live event stream (seeded from /api/homecore/events, then prepended live from
 // the shared WS bus — never polled, §2/§4.4), a context-causality
 // breadcrumb on row expand (Context.id → parent_id → grandparent_id),
 // and a trigger→condition→action automation builder (ADR-129 scope:
@@ -50,7 +50,7 @@ export default {
 
     root.appendChild(sectionHeader('Event Bus & Automation', 'Live entity events + causality + automation builder (ADR-131 §4.8, ADR-129)'));
     if (api.isDemo('events')) {
-      root.appendChild(banner('DEMO — event history is contract-conformant mock data until the live /api/events feed lands (§7.1). New rows still arrive over the WS bus.', 'amber'));
+      root.appendChild(banner('DEMO — event history is contract-conformant mock data until the live /api/homecore/events feed lands (§7.1). New rows still arrive over the WS bus.', 'amber'));
     }
 
     // ── live lag indicator (top, fed by the shared WS bus) ──────────

From d8dcccda282d92c6b0d87eff7e7c235e28469937 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:22:57 -0400
Subject: [PATCH 07/16] feat(homecore): load signed native and Wasmtime plugins

---
 v2/crates/homecore-plugins/src/discovery.rs   | 270 ++++++++++++++++++
 v2/crates/homecore-plugins/src/error.rs       |   8 +
 v2/crates/homecore-plugins/src/lib.rs         |   2 +
 v2/crates/homecore-plugins/src/plugin.rs      |   9 +-
 v2/crates/homecore-plugins/src/registry.rs    |  70 +++--
 v2/crates/homecore-plugins/src/runtime.rs     |   6 +
 .../homecore-plugins/src/wasmtime_runtime.rs  | 108 ++++++-
 v2/crates/homecore-server/Cargo.toml          |   4 +-
 v2/crates/homecore-server/src/plugins.rs      | 215 ++++++++++++++
 9 files changed, 666 insertions(+), 26 deletions(-)
 create mode 100644 v2/crates/homecore-plugins/src/discovery.rs
 create mode 100644 v2/crates/homecore-server/src/plugins.rs

diff --git a/v2/crates/homecore-plugins/src/discovery.rs b/v2/crates/homecore-plugins/src/discovery.rs
new file mode 100644
index 00000000..bfa8454d
--- /dev/null
+++ b/v2/crates/homecore-plugins/src/discovery.rs
@@ -0,0 +1,270 @@
+//! Secure filesystem discovery for packaged WASM plugins.
+//!
+//! A plugin directory has exactly this shape:
+//!
+//! ```text
+//! <configured-root>/<package>/manifest.json
+//!                              <module named by wasm_module>
+//! ```
+//!
+//! Only immediate child directories of explicitly configured roots are
+//! inspected. Symlinks are rejected and the module must be a plain filename
+//! in the same package directory. This deliberately avoids recursive search,
+//! implicit current-directory loading, and path traversal.
+
+use std::collections::BTreeSet;
+use std::fs;
+use std::path::{Component, Path, PathBuf};
+
+use crate::{PluginError, PluginManifest};
+
+/// Conservative input limits applied before allocating file contents.
+#[derive(Debug, Clone, Copy)]
+pub struct DiscoveryLimits {
+    pub max_plugins: usize,
+    pub max_manifest_bytes: u64,
+    pub max_module_bytes: u64,
+}
+
+impl Default for DiscoveryLimits {
+    fn default() -> Self {
+        Self {
+            max_plugins: 128,
+            max_manifest_bytes: 256 * 1024,
+            max_module_bytes: 16 * 1024 * 1024,
+        }
+    }
+}
+
+/// A validated package whose files are safe to read.
+#[derive(Debug, Clone)]
+pub struct DiscoveredPlugin {
+    pub manifest: PluginManifest,
+    pub package_dir: PathBuf,
+    pub manifest_path: PathBuf,
+    pub module_path: PathBuf,
+}
+
+impl DiscoveredPlugin {
+    /// Read the module after re-checking its type and size. Re-checking closes
+    /// the common accidental replacement window between discovery and load;
+    /// signature verification remains the authoritative tamper gate.
+    pub fn read_module(&self, limits: DiscoveryLimits) -> Result<Vec<u8>, PluginError> {
+        bounded_regular_file(&self.module_path, limits.max_module_bytes, "WASM module")
+    }
+}
+
+/// Discover packages in deterministic root/path order.
+pub fn discover_plugins(
+    roots: &[PathBuf],
+    limits: DiscoveryLimits,
+) -> Result<Vec<DiscoveredPlugin>, PluginError> {
+    if roots.is_empty() {
+        return Ok(Vec::new());
+    }
+    if limits.max_plugins == 0 || limits.max_manifest_bytes == 0 || limits.max_module_bytes == 0 {
+        return Err(PluginError::ResourceLimit(
+            "discovery limits must all be greater than zero".into(),
+        ));
+    }
+
+    let mut packages = BTreeSet::new();
+    for configured_root in roots {
+        let metadata = fs::symlink_metadata(configured_root).map_err(|e| {
+            PluginError::Discovery(format!(
+                "cannot inspect configured plugin root {}: {e}",
+                configured_root.display()
+            ))
+        })?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            return Err(PluginError::Discovery(format!(
+                "configured plugin root must be a real directory, not a symlink: {}",
+                configured_root.display()
+            )));
+        }
+        let root = fs::canonicalize(configured_root)?;
+        let entries = fs::read_dir(&root)?;
+        for entry in entries {
+            let entry = entry?;
+            let ty = entry.file_type()?;
+            if ty.is_symlink() {
+                return Err(PluginError::Discovery(format!(
+                    "symlink found in plugin root: {}",
+                    entry.path().display()
+                )));
+            }
+            if ty.is_dir() && entry.path().join("manifest.json").exists() {
+                packages.insert(entry.path());
+            }
+        }
+    }
+
+    if packages.len() > limits.max_plugins {
+        return Err(PluginError::ResourceLimit(format!(
+            "discovered {} plugins, maximum is {}",
+            packages.len(),
+            limits.max_plugins
+        )));
+    }
+
+    let mut result = Vec::with_capacity(packages.len());
+    let mut domains = BTreeSet::new();
+    for package_dir in packages {
+        let package_dir = fs::canonicalize(package_dir)?;
+        let manifest_path = package_dir.join("manifest.json");
+        let manifest_bytes =
+            bounded_regular_file(&manifest_path, limits.max_manifest_bytes, "manifest")?;
+        let manifest_text = std::str::from_utf8(&manifest_bytes).map_err(|e| {
+            PluginError::InvalidManifest(format!(
+                "{} is not UTF-8: {e}",
+                manifest_path.display()
+            ))
+        })?;
+        let manifest = PluginManifest::parse_json(manifest_text)?;
+        if !domains.insert(manifest.domain.clone()) {
+            return Err(PluginError::Discovery(format!(
+                "duplicate plugin domain `{}`",
+                manifest.domain
+            )));
+        }
+        let module_name = manifest.wasm_module.as_deref().ok_or_else(|| {
+            PluginError::InvalidManifest(format!(
+                "WASM package `{}` has no wasm_module",
+                manifest.domain
+            ))
+        })?;
+        let relative = Path::new(module_name);
+        if relative.components().count() != 1
+            || !matches!(relative.components().next(), Some(Component::Normal(_)))
+            || relative.extension().and_then(|v| v.to_str()) != Some("wasm")
+        {
+            return Err(PluginError::InvalidManifest(format!(
+                "plugin `{}` wasm_module must be a .wasm filename in its package directory",
+                manifest.domain
+            )));
+        }
+        let module_path = package_dir.join(relative);
+        let metadata = fs::symlink_metadata(&module_path).map_err(|e| {
+            PluginError::Discovery(format!("cannot inspect {}: {e}", module_path.display()))
+        })?;
+        if metadata.file_type().is_symlink() || !metadata.is_file() {
+            return Err(PluginError::Discovery(format!(
+                "plugin module must be a regular non-symlink file: {}",
+                module_path.display()
+            )));
+        }
+        if metadata.len() > limits.max_module_bytes {
+            return Err(PluginError::ResourceLimit(format!(
+                "{} is {} bytes; maximum is {}",
+                module_path.display(),
+                metadata.len(),
+                limits.max_module_bytes
+            )));
+        }
+        result.push(DiscoveredPlugin {
+            manifest,
+            package_dir,
+            manifest_path,
+            module_path,
+        });
+    }
+    Ok(result)
+}
+
+fn bounded_regular_file(path: &Path, maximum: u64, kind: &str) -> Result<Vec<u8>, PluginError> {
+    let metadata = fs::symlink_metadata(path)?;
+    if metadata.file_type().is_symlink() || !metadata.is_file() {
+        return Err(PluginError::Discovery(format!(
+            "{kind} must be a regular non-symlink file: {}",
+            path.display()
+        )));
+    }
+    if metadata.len() > maximum {
+        return Err(PluginError::ResourceLimit(format!(
+            "{} is {} bytes; maximum is {}",
+            path.display(),
+            metadata.len(),
+            maximum
+        )));
+    }
+    let bytes = fs::read(path)?;
+    if bytes.len() as u64 > maximum {
+        return Err(PluginError::ResourceLimit(format!(
+            "{} grew beyond the {maximum}-byte limit while being read",
+            path.display()
+        )));
+    }
+    Ok(bytes)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn root() -> PathBuf {
+        let path = std::env::temp_dir().join(format!(
+            "homecore-plugin-discovery-{}-{}",
+            std::process::id(),
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        fs::create_dir(&path).unwrap();
+        path
+    }
+
+    fn package(root: &Path, directory: &str, domain: &str, module: &str) {
+        let dir = root.join(directory);
+        fs::create_dir(&dir).unwrap();
+        fs::write(
+            dir.join("manifest.json"),
+            format!(
+                r#"{{"domain":"{domain}","name":"Test","version":"1","wasm_module":"{module}"}}"#
+            ),
+        )
+        .unwrap();
+        if !module.contains('/') && !module.contains('\\') && module.ends_with(".wasm") {
+            fs::write(dir.join(module), b"\0asm\x01\0\0\0").unwrap();
+        }
+    }
+
+    #[test]
+    fn discovery_is_sorted_and_only_reads_explicit_roots() {
+        let root = root();
+        package(&root, "z-last", "zeta", "z.wasm");
+        package(&root, "a-first", "alpha", "a.wasm");
+        let found = discover_plugins(&[root.clone()], DiscoveryLimits::default()).unwrap();
+        assert_eq!(
+            found.iter().map(|p| p.manifest.domain.as_str()).collect::<Vec<_>>(),
+            ["alpha", "zeta"]
+        );
+        fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn traversal_module_path_is_rejected() {
+        let root = root();
+        package(&root, "bad", "bad", "../bad.wasm");
+        let error = discover_plugins(&[root.clone()], DiscoveryLimits::default()).unwrap_err();
+        assert!(matches!(error, PluginError::InvalidManifest(_)));
+        fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn size_limits_are_enforced_before_read() {
+        let root = root();
+        package(&root, "large", "large", "large.wasm");
+        let error = discover_plugins(
+            &[root.clone()],
+            DiscoveryLimits {
+                max_module_bytes: 4,
+                ..DiscoveryLimits::default()
+            },
+        )
+        .unwrap_err();
+        assert!(matches!(error, PluginError::ResourceLimit(_)));
+        fs::remove_dir_all(root).unwrap();
+    }
+}
diff --git a/v2/crates/homecore-plugins/src/error.rs b/v2/crates/homecore-plugins/src/error.rs
index 468aa801..6c2cf20b 100644
--- a/v2/crates/homecore-plugins/src/error.rs
+++ b/v2/crates/homecore-plugins/src/error.rs
@@ -21,6 +21,14 @@ pub enum PluginError {
     #[error("runtime error: {0}")]
     RuntimeError(String),
 
+    /// Plugin discovery or filesystem layout is invalid.
+    #[error("plugin discovery failed: {0}")]
+    Discovery(String),
+
+    /// A configured manifest, module, or ABI payload exceeds its limit.
+    #[error("plugin resource limit exceeded: {0}")]
+    ResourceLimit(String),
+
     /// The plugin's `setup` hook returned an error.
     #[error("plugin setup failed: {0}")]
     SetupFailed(String),
diff --git a/v2/crates/homecore-plugins/src/lib.rs b/v2/crates/homecore-plugins/src/lib.rs
index c64d7d9f..a0ec6665 100644
--- a/v2/crates/homecore-plugins/src/lib.rs
+++ b/v2/crates/homecore-plugins/src/lib.rs
@@ -41,6 +41,7 @@
 //! | `wasm3` | off | wasm3 interpreter runtime for constrained hardware (P3) |
 
 pub mod error;
+pub mod discovery;
 pub mod host_abi;
 pub mod manifest;
 pub mod permissions;
@@ -53,6 +54,7 @@ pub mod verify;
 pub mod wasmtime_runtime;
 
 pub use error::PluginError;
+pub use discovery::{discover_plugins, DiscoveredPlugin, DiscoveryLimits};
 pub use host_abi::{ConfigEntryJson, StateChangedEventJson};
 pub use manifest::{IotClass, IntegrationType, PluginManifest};
 pub use permissions::PermissionSet;
diff --git a/v2/crates/homecore-plugins/src/plugin.rs b/v2/crates/homecore-plugins/src/plugin.rs
index 634a72cd..4424cf32 100644
--- a/v2/crates/homecore-plugins/src/plugin.rs
+++ b/v2/crates/homecore-plugins/src/plugin.rs
@@ -11,10 +11,11 @@ use async_trait::async_trait;
 use homecore::HomeCore;
 
 use crate::error::PluginError;
+use crate::StateChangedEventJson;
 
 /// Unique identifier for a loaded plugin — mirrors the `domain` field of
 /// the plugin's `PluginManifest` (e.g. `"mqtt"`, `"homecore_lights"`).
-#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub struct PluginId(pub String);
 
 impl PluginId {
@@ -52,6 +53,12 @@ pub trait HomeCorePlugin: Send + Sync + 'static {
     /// register its entities, services, and event subscriptions here.
     async fn setup(&self, hc: HomeCore) -> Result<(), PluginError>;
 
+    /// Receive a committed state change. The default is a no-op so built-in
+    /// plugins only opt into event work they need.
+    async fn state_changed(&self, _event: &StateChangedEventJson) -> Result<(), PluginError> {
+        Ok(())
+    }
+
     /// Called when the plugin is being removed from the registry.
     ///
     /// The plugin should clean up subscriptions and deregister its entities.
diff --git a/v2/crates/homecore-plugins/src/registry.rs b/v2/crates/homecore-plugins/src/registry.rs
index 28131d36..cff8a475 100644
--- a/v2/crates/homecore-plugins/src/registry.rs
+++ b/v2/crates/homecore-plugins/src/registry.rs
@@ -5,7 +5,7 @@
 //! the `InProcessRuntime` (P1) for a `WasmtimeRuntime` (P2) without
 //! changing registry code.
 
-use std::collections::HashMap;
+use std::collections::{BTreeMap, BTreeSet};
 use std::sync::Arc;
 
 use homecore::HomeCore;
@@ -15,6 +15,7 @@ use crate::error::PluginError;
 use crate::manifest::PluginManifest;
 use crate::plugin::{HomeCorePlugin, PluginId};
 use crate::runtime::{LoadedPlugin, PluginRuntime};
+use crate::StateChangedEventJson;
 
 /// Holds all loaded plugins keyed by `PluginId`.
 ///
@@ -22,7 +23,8 @@ use crate::runtime::{LoadedPlugin, PluginRuntime};
 /// unload) take an exclusive lock only while mutating the map.
 pub struct PluginRegistry<R: PluginRuntime> {
     runtime: R,
-    plugins: RwLock<HashMap<PluginId, LoadedPlugin>>,
+    plugins: RwLock<BTreeMap<PluginId, LoadedPlugin>>,
+    loading: RwLock<BTreeSet<PluginId>>,
 }
 
 impl<R: PluginRuntime> PluginRegistry<R> {
@@ -30,7 +32,8 @@ impl<R: PluginRuntime> PluginRegistry<R> {
     pub fn new(runtime: R) -> Self {
         Self {
             runtime,
-            plugins: RwLock::new(HashMap::new()),
+            plugins: RwLock::new(BTreeMap::new()),
+            loading: RwLock::new(BTreeSet::new()),
         }
     }
 
@@ -48,22 +51,31 @@ impl<R: PluginRuntime> PluginRegistry<R> {
 
         {
             let guard = self.plugins.read().await;
-            if guard.contains_key(&id) {
+            let mut loading = self.loading.write().await;
+            if guard.contains_key(&id) || !loading.insert(id.clone()) {
                 return Err(PluginError::AlreadyLoaded(id.to_string()));
             }
         }
 
-        let loaded = self
+        let result = self
             .runtime
             .load(id.clone(), manifest, plugin)
-            .await?;
-
-        loaded
-            .setup(hc)
-            .await
-            .map_err(|e| PluginError::SetupFailed(e.to_string()))?;
-
+            .await;
+        let loaded = match result {
+            Ok(loaded) => loaded,
+            Err(error) => {
+                self.loading.write().await.remove(&id);
+                return Err(error);
+            }
+        };
+        if let Err(error) = loaded.setup(hc).await {
+            // Best-effort rollback for partially initialized plugins.
+            let _ = loaded.unload().await;
+            self.loading.write().await.remove(&id);
+            return Err(PluginError::SetupFailed(error.to_string()));
+        }
         self.plugins.write().await.insert(id.clone(), loaded);
+        self.loading.write().await.remove(&id);
         Ok(id)
     }
 
@@ -78,10 +90,11 @@ impl<R: PluginRuntime> PluginRegistry<R> {
                 .ok_or_else(|| PluginError::NotFound(id.to_string()))?
         };
 
-        loaded
-            .unload()
-            .await
-            .map_err(|e| PluginError::UnloadFailed(e.to_string()))?;
+        if let Err(error) = loaded.unload().await {
+            // Keep the handle reachable so teardown can be retried.
+            self.plugins.write().await.insert(id.clone(), loaded);
+            return Err(PluginError::UnloadFailed(error.to_string()));
+        }
 
         Ok(())
     }
@@ -99,4 +112,29 @@ impl<R: PluginRuntime> PluginRegistry<R> {
     pub async fn contains(&self, id: &PluginId) -> bool {
         self.plugins.read().await.contains_key(id)
     }
+
+    /// Dispatch a state change in stable plugin-domain order.
+    pub async fn state_changed(&self, event: &StateChangedEventJson) -> Vec<(PluginId, PluginError)> {
+        let guard = self.plugins.read().await;
+        let mut errors = Vec::new();
+        for (id, plugin) in guard.iter() {
+            if let Err(error) = plugin.state_changed(event).await {
+                errors.push((id.clone(), error));
+            }
+        }
+        errors
+    }
+
+    /// Tear down all plugins in reverse domain order. Failures are collected
+    /// while remaining plugins still receive teardown.
+    pub async fn shutdown(&self) -> Vec<(PluginId, PluginError)> {
+        let ids: Vec<_> = self.plugins.read().await.keys().cloned().rev().collect();
+        let mut errors = Vec::new();
+        for id in ids {
+            if let Err(error) = self.unload(&id).await {
+                errors.push((id, error));
+            }
+        }
+        errors
+    }
 }
diff --git a/v2/crates/homecore-plugins/src/runtime.rs b/v2/crates/homecore-plugins/src/runtime.rs
index 9ff45ac9..ee00a47f 100644
--- a/v2/crates/homecore-plugins/src/runtime.rs
+++ b/v2/crates/homecore-plugins/src/runtime.rs
@@ -23,6 +23,7 @@ use homecore::HomeCore;
 use crate::error::PluginError;
 use crate::manifest::PluginManifest;
 use crate::plugin::{HomeCorePlugin, PluginId};
+use crate::StateChangedEventJson;
 
 /// A loaded plugin handle — returned by [`PluginRuntime::load`].
 pub struct LoadedPlugin {
@@ -42,6 +43,11 @@ impl LoadedPlugin {
     pub async fn unload(&self) -> Result<(), PluginError> {
         self.instance.unload().await
     }
+
+    /// Dispatch a committed state change to this plugin.
+    pub async fn state_changed(&self, event: &StateChangedEventJson) -> Result<(), PluginError> {
+        self.instance.state_changed(event).await
+    }
 }
 
 /// Abstraction over the WASM (and native) plugin execution environment.
diff --git a/v2/crates/homecore-plugins/src/wasmtime_runtime.rs b/v2/crates/homecore-plugins/src/wasmtime_runtime.rs
index 3d4ca570..85615988 100644
--- a/v2/crates/homecore-plugins/src/wasmtime_runtime.rs
+++ b/v2/crates/homecore-plugins/src/wasmtime_runtime.rs
@@ -26,7 +26,7 @@
 use std::sync::{Arc, Mutex};
 
 use homecore::HomeCore;
-use wasmtime::{Engine, Linker, Module, Store};
+use wasmtime::{Config, Engine, Linker, Module, Store, StoreLimits, StoreLimitsBuilder};
 
 use crate::error::PluginError;
 use crate::host_abi::{LogLevel, StateChangedEventJson, MAX_ABI_BUFFER_BYTES};
@@ -34,6 +34,13 @@ use crate::manifest::PluginManifest;
 use crate::permissions::PermissionSet;
 use crate::verify::{verify_module, PluginPolicy};
 
+/// Hard ceiling for every module accepted by the runtime, including callers
+/// that bypass filesystem discovery.
+pub const MAX_WASM_MODULE_BYTES: usize = 16 * 1024 * 1024;
+const MAX_SUBSCRIPTIONS: usize = 4096;
+const MAX_LINEAR_MEMORY_BYTES: usize = 16 * 1024 * 1024;
+const FUEL_PER_CALL: u64 = 10_000_000;
+
 // ── Store data ─────────────────────────────────────────────────────────────
 
 /// Per-plugin state stored inside the Wasmtime [`Store`].
@@ -51,6 +58,7 @@ pub struct PluginStoreData {
     /// [`WasmtimeRuntime::load_plugin`] path installs the manifest's
     /// declared set.
     pub permissions: PermissionSet,
+    limits: StoreLimits,
 }
 
 // ── WasmtimeRuntime ────────────────────────────────────────────────────────
@@ -66,7 +74,10 @@ pub struct WasmtimeRuntime {
 impl WasmtimeRuntime {
     /// Create a new runtime with default Cranelift config.
     pub fn new() -> Result<Self, PluginError> {
-        let engine = Engine::default();
+        let mut config = Config::new();
+        config.consume_fuel(true);
+        let engine = Engine::new(&config)
+            .map_err(|e| PluginError::RuntimeError(format!("Wasmtime engine: {e}")))?;
         Ok(Self { engine })
     }
 
@@ -83,6 +94,7 @@ impl WasmtimeRuntime {
         wasm_bytes: &[u8],
         hc: HomeCore,
     ) -> Result<WasmPlugin, PluginError> {
+        check_module_size(wasm_bytes)?;
         self.instantiate(wasm_bytes, hc, PermissionSet::allow_all())
     }
 
@@ -104,6 +116,7 @@ impl WasmtimeRuntime {
         hc: HomeCore,
         policy: &PluginPolicy,
     ) -> Result<WasmPlugin, PluginError> {
+        check_module_size(wasm_bytes)?;
         // P4: verify before instantiation.
         verify_module(manifest, wasm_bytes, policy)?;
         // P5: scope write authority to the manifest's declared permissions.
@@ -128,8 +141,17 @@ impl WasmtimeRuntime {
             hc,
             subscriptions: Vec::new(),
             permissions,
+            limits: StoreLimitsBuilder::new()
+                .memory_size(MAX_LINEAR_MEMORY_BYTES)
+                .instances(1)
+                .memories(1)
+                .build(),
         };
         let mut store = Store::new(&self.engine, store_data);
+        store.limiter(|data| &mut data.limits);
+        store
+            .set_fuel(FUEL_PER_CALL)
+            .map_err(|e| PluginError::RuntimeError(format!("set instantiation fuel: {e}")))?;
 
         let instance = linker
             .instantiate(&mut store, &module)
@@ -179,6 +201,12 @@ fn register_hc_state_get(
              out_ptr: i32,
              out_cap: i32|
              -> i32 {
+                if out_ptr < 0
+                    || out_cap < 0
+                    || out_cap as usize > MAX_ABI_BUFFER_BYTES
+                {
+                    return -1;
+                }
                 // Phase 1: read the entity key from guest memory.
                 let key: String = {
                     let mem = match caller.get_export("memory") {
@@ -216,7 +244,9 @@ fn register_hc_state_get(
                     Some(wasmtime::Extern::Memory(m)) => m,
                     _ => return -1,
                 };
-                let end = out_ptr as usize + json_bytes.len();
+                let Some(end) = (out_ptr as usize).checked_add(json_bytes.len()) else {
+                    return -1;
+                };
                 let out = match mem.data_mut(&mut caller).get_mut(out_ptr as usize..end) {
                     Some(s) => s,
                     None => return -1,
@@ -331,7 +361,15 @@ fn register_hc_state_subscribe(
                         None => return -1,
                     }
                 };
-                caller.data_mut().subscriptions.push(eid);
+                if homecore::EntityId::parse(&eid).is_err() {
+                    return -1;
+                }
+                if caller.data().subscriptions.len() >= MAX_SUBSCRIPTIONS {
+                    return -2;
+                }
+                if !caller.data().subscriptions.contains(&eid) {
+                    caller.data_mut().subscriptions.push(eid);
+                }
                 0
             },
         )
@@ -374,6 +412,7 @@ fn register_hc_log(
 ///
 /// The `Arc<Mutex<_>>` allows the handle to be `Clone` + `Send` while
 /// maintaining exclusive access for calls into the WASM module.
+#[derive(Clone)]
 pub struct WasmPlugin {
     pub inner: Arc<Mutex<(Store<PluginStoreData>, wasmtime::Instance)>>,
 }
@@ -394,6 +433,9 @@ impl WasmPlugin {
             .lock()
             .map_err(|e| PluginError::RuntimeError(format!("lock: {e}")))?;
         let (store, instance) = &mut *guard;
+        store
+            .set_fuel(FUEL_PER_CALL)
+            .map_err(|e| PluginError::RuntimeError(format!("set call fuel: {e}")))?;
         call_export_str(store, instance, "plugin_setup", config_entry_json)
     }
 
@@ -409,20 +451,46 @@ impl WasmPlugin {
             .lock()
             .map_err(|e| PluginError::RuntimeError(format!("lock: {e}")))?;
         let (store, instance) = &mut *guard;
+        store
+            .set_fuel(FUEL_PER_CALL)
+            .map_err(|e| PluginError::RuntimeError(format!("set call fuel: {e}")))?;
         call_export_str(store, instance, "plugin_handle_state_changed", &json)
     }
+
+    /// Call an optional `plugin_teardown() -> i32` export. Older modules that
+    /// do not export teardown remain compatible; new modules can release
+    /// guest-owned resources deterministically.
+    pub fn call_teardown(&self) -> Result<i32, PluginError> {
+        let mut guard = self
+            .inner
+            .lock()
+            .map_err(|e| PluginError::RuntimeError(format!("lock: {e}")))?;
+        let (store, instance) = &mut *guard;
+        store
+            .set_fuel(FUEL_PER_CALL)
+            .map_err(|e| PluginError::RuntimeError(format!("set call fuel: {e}")))?;
+        let Some(func) = instance.get_func(&mut *store, "plugin_teardown") else {
+            return Ok(0);
+        };
+        let func = func.typed::<(), i32>(&*store).map_err(|e| {
+            PluginError::RuntimeError(format!("plugin_teardown has invalid signature: {e}"))
+        })?;
+        func.call(&mut *store, ())
+            .map_err(|e| PluginError::RuntimeError(format!("call plugin_teardown: {e}")))
+    }
 }
 
 // ── Memory helpers ─────────────────────────────────────────────────────────
 
 /// Read a UTF-8 string from guest linear memory.
 fn read_str(mem: &[u8], ptr: i32, len: i32) -> Option<&str> {
-    if len < 0 || len as usize > MAX_ABI_BUFFER_BYTES {
+    if ptr < 0 || len < 0 || len as usize > MAX_ABI_BUFFER_BYTES {
         return None;
     }
     let ptr = ptr as usize;
     let len = len as usize;
-    let slice = mem.get(ptr..ptr + len)?;
+    let end = ptr.checked_add(len)?;
+    let slice = mem.get(ptr..end)?;
     std::str::from_utf8(slice).ok()
 }
 
@@ -435,6 +503,13 @@ fn call_export_str(
     payload: &str,
 ) -> Result<i32, PluginError> {
     let payload_bytes = payload.as_bytes().to_vec(); // owned copy avoids reborrow issues
+    if payload_bytes.len() > MAX_ABI_BUFFER_BYTES {
+        return Err(PluginError::ResourceLimit(format!(
+            "ABI payload is {} bytes; maximum is {}",
+            payload_bytes.len(),
+            MAX_ABI_BUFFER_BYTES
+        )));
+    }
     let payload_len = payload_bytes.len() as i32;
 
     // 1. Allocate guest buffer.
@@ -444,15 +519,23 @@ fn call_export_str(
     let ptr = alloc
         .call(&mut *store, payload_len)
         .map_err(|e| PluginError::RuntimeError(format!("call alloc: {e}")))?;
+    if ptr < 0 {
+        return Err(PluginError::RuntimeError(
+            "guest alloc returned a negative pointer".into(),
+        ));
+    }
 
     // 2. Write payload into guest memory.
     {
         let mem = instance
             .get_memory(&mut *store, "memory")
             .ok_or_else(|| PluginError::RuntimeError("no memory export".into()))?;
+        let end = (ptr as usize)
+            .checked_add(payload_bytes.len())
+            .ok_or_else(|| PluginError::RuntimeError("guest allocation overflow".into()))?;
         let guest_slice = mem
             .data_mut(&mut *store)
-            .get_mut(ptr as usize..ptr as usize + payload_bytes.len())
+            .get_mut(ptr as usize..end)
             .ok_or_else(|| PluginError::RuntimeError("guest memory OOB".into()))?;
         guest_slice.copy_from_slice(&payload_bytes);
     }
@@ -476,6 +559,17 @@ fn call_export_str(
     Ok(result)
 }
 
+fn check_module_size(wasm_bytes: &[u8]) -> Result<(), PluginError> {
+    if wasm_bytes.len() > MAX_WASM_MODULE_BYTES {
+        return Err(PluginError::ResourceLimit(format!(
+            "WASM module is {} bytes; maximum is {}",
+            wasm_bytes.len(),
+            MAX_WASM_MODULE_BYTES
+        )));
+    }
+    Ok(())
+}
+
 // ── Unit tests (using inline WAT) ──────────────────────────────────────────
 
 #[cfg(test)]
diff --git a/v2/crates/homecore-server/Cargo.toml b/v2/crates/homecore-server/Cargo.toml
index 5a483acd..0bb62d61 100644
--- a/v2/crates/homecore-server/Cargo.toml
+++ b/v2/crates/homecore-server/Cargo.toml
@@ -23,7 +23,7 @@ path = "src/main.rs"
 # The 8 HOMECORE crates this binary integrates
 homecore           = { path = "../homecore",           version = "0.1.0-alpha.0" }
 homecore-api       = { path = "../homecore-api",       version = "0.1.0-alpha.0" }
-homecore-plugins   = { path = "../homecore-plugins", version = "0.1.0-alpha.0", optional = true }
+homecore-plugins   = { path = "../homecore-plugins", version = "0.1.0-alpha.0" }
 homecore-recorder  = { path = "../homecore-recorder",  version = "0.1.0-alpha.0" }
 # Reuse version-gated registry envelope parsing in the isolated restore module.
 homecore-migrate   = { path = "../homecore-migrate",   version = "0.1.0-alpha.0" }
@@ -65,4 +65,4 @@ default = []
 # Pull in ruvector-backed semantic memory.
 ruvector = ["homecore-recorder/ruvector"]
 # Pull in real Wasmtime plugin runtime (vs InProcessRuntime).
-wasmtime = ["dep:homecore-plugins", "homecore-plugins/wasmtime"]
+wasmtime = ["homecore-plugins/wasmtime"]
diff --git a/v2/crates/homecore-server/src/plugins.rs b/v2/crates/homecore-server/src/plugins.rs
new file mode 100644
index 00000000..5693921f
--- /dev/null
+++ b/v2/crates/homecore-server/src/plugins.rs
@@ -0,0 +1,215 @@
+//! Server ownership for plugin discovery, setup, event dispatch, and teardown.
+//!
+//! Native Rust plugins are never discovered from disk. They must be compiled
+//! into this binary and exposed through [`NativePluginRegistration`]. External
+//! packages are WebAssembly only and require the `wasmtime` feature.
+
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use anyhow::{Context as _, Result};
+use homecore::HomeCore;
+use homecore_plugins::{
+    DiscoveryLimits, HomeCorePlugin, InProcessRuntime, PluginError, PluginManifest,
+    PluginRegistry, StateChangedEventJson,
+};
+use tokio::task::JoinHandle;
+use tracing::{error, info, warn};
+
+#[cfg(feature = "wasmtime")]
+use homecore_plugins::{
+    discover_plugins, ConfigEntryJson, PluginId, PluginPolicy, WasmPlugin, WasmtimeRuntime,
+};
+
+/// Factory entry for a trusted plugin linked into the server at compile time.
+pub struct NativePluginRegistration {
+    pub create:
+        fn() -> Result<(PluginManifest, Arc<dyn HomeCorePlugin>), PluginError>,
+}
+
+/// This is intentionally empty in the generic server. Appliance builds can
+/// add first-party registrations here; arbitrary Rust cdylibs are unsupported.
+const NATIVE_PLUGINS: &[NativePluginRegistration] = &[];
+
+#[derive(Debug, Clone)]
+pub struct PluginConfig {
+    pub directories: Vec<PathBuf>,
+    pub trusted_publishers: Vec<String>,
+    pub allow_unsigned: bool,
+    pub limits: DiscoveryLimits,
+}
+
+pub struct ServerPlugins {
+    native: Arc<PluginRegistry<InProcessRuntime>>,
+    dispatcher: JoinHandle<()>,
+    #[cfg(feature = "wasmtime")]
+    wasm: Vec<(PluginId, WasmPlugin)>,
+}
+
+impl ServerPlugins {
+    /// Start the complete plugin subsystem. Any configured package that fails
+    /// discovery, trust verification, compilation, or setup aborts startup.
+    pub async fn start(hc: HomeCore, config: PluginConfig) -> Result<Self> {
+        let native = Arc::new(PluginRegistry::new(InProcessRuntime));
+        for registration in NATIVE_PLUGINS {
+            let (manifest, plugin) = (registration.create)()
+                .context("compiled-in native plugin factory failed")?;
+            native
+                .load(manifest, plugin, hc.clone())
+                .await
+                .context("compiled-in native plugin setup failed")?;
+        }
+
+        #[cfg(not(feature = "wasmtime"))]
+        if !config.directories.is_empty() {
+            anyhow::bail!(
+                "plugin directories were configured, but homecore-server was built without \
+                 --features wasmtime"
+            );
+        }
+        #[cfg(not(feature = "wasmtime"))]
+        if config.allow_unsigned || !config.trusted_publishers.is_empty() {
+            anyhow::bail!(
+                "plugin trust options were configured, but homecore-server was built without \
+                 --features wasmtime"
+            );
+        }
+
+        #[cfg(feature = "wasmtime")]
+        let wasm = load_wasm_plugins(&hc, &config).await?;
+
+        let mut receiver = hc.states().subscribe();
+        let dispatch_native = native.clone();
+        #[cfg(feature = "wasmtime")]
+        let dispatch_wasm = wasm.clone();
+        let dispatcher = tokio::spawn(async move {
+            loop {
+                let change = match receiver.recv().await {
+                    Ok(change) => change,
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {
+                        warn!(skipped, "plugin state dispatcher lagged; events were dropped");
+                        continue;
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+                };
+                let event = StateChangedEventJson::state_changed(
+                    change.entity_id.as_str(),
+                    change.new_state.as_ref().map(|state| state.state.as_str()),
+                    change
+                        .new_state
+                        .as_ref()
+                        .map(|state| state.attributes.clone())
+                        .unwrap_or_else(|| serde_json::json!({})),
+                );
+                for (id, error) in dispatch_native.state_changed(&event).await {
+                    error!(plugin = %id, %error, "native plugin state_changed failed");
+                }
+                #[cfg(feature = "wasmtime")]
+                for (id, plugin) in &dispatch_wasm {
+                    if !plugin.subscriptions().iter().any(|entity| entity == change.entity_id.as_str())
+                    {
+                        continue;
+                    }
+                    let plugin = plugin.clone();
+                    let id = id.clone();
+                    let event = StateChangedEventJson::state_changed(
+                        &event.entity_id,
+                        event.new_state.as_deref(),
+                        event.attributes.clone(),
+                    );
+                    match tokio::task::spawn_blocking(move || plugin.call_state_changed(&event)).await
+                    {
+                        Ok(Ok(0)) => {}
+                        Ok(Ok(code)) => error!(plugin = %id, code, "WASM state_changed returned failure"),
+                        Ok(Err(error)) => error!(plugin = %id, %error, "WASM state_changed trapped"),
+                        Err(error) => error!(plugin = %id, %error, "WASM dispatch task failed"),
+                    }
+                }
+            }
+        });
+
+        info!(
+            native = NATIVE_PLUGINS.len(),
+            #[cfg(feature = "wasmtime")]
+            wasm = wasm.len(),
+            "plugin subsystem started"
+        );
+        Ok(Self {
+            native,
+            dispatcher,
+            #[cfg(feature = "wasmtime")]
+            wasm,
+        })
+    }
+
+    /// Stop dispatch first, then tear down WASM and native plugins in reverse
+    /// deterministic order. All teardown failures are reported.
+    pub async fn shutdown(self) {
+        self.dispatcher.abort();
+        let _ = self.dispatcher.await;
+        #[cfg(feature = "wasmtime")]
+        for (id, plugin) in self.wasm.into_iter().rev() {
+            match tokio::task::spawn_blocking(move || plugin.call_teardown()).await {
+                Ok(Ok(0)) => {}
+                Ok(Ok(code)) => error!(plugin = %id, code, "WASM teardown returned failure"),
+                Ok(Err(error)) => error!(plugin = %id, %error, "WASM teardown trapped"),
+                Err(error) => error!(plugin = %id, %error, "WASM teardown task failed"),
+            }
+        }
+        for (id, error) in self.native.shutdown().await {
+            error!(plugin = %id, %error, "native plugin teardown failed");
+        }
+    }
+}
+
+#[cfg(feature = "wasmtime")]
+async fn load_wasm_plugins(
+    hc: &HomeCore,
+    config: &PluginConfig,
+) -> Result<Vec<(PluginId, WasmPlugin)>> {
+    let policy = if config.allow_unsigned {
+        warn!("INSECURE plugin policy enabled: unsigned plugins may execute");
+        PluginPolicy::AllowUnsigned
+    } else {
+        let keys: Vec<_> = config.trusted_publishers.iter().map(String::as_str).collect();
+        PluginPolicy::trusted(&keys).context("invalid trusted plugin publisher key")?
+    };
+    let discovered = discover_plugins(&config.directories, config.limits)
+        .context("plugin discovery failed")?;
+    let runtime = WasmtimeRuntime::new().context("Wasmtime initialization failed")?;
+    let mut loaded: Vec<(PluginId, WasmPlugin)> = Vec::with_capacity(discovered.len());
+    for package in discovered {
+        let id = PluginId::new(&package.manifest.domain);
+        let bytes = package
+            .read_module(config.limits)
+            .with_context(|| format!("failed reading plugin `{id}`"))?;
+        let plugin = runtime
+            .load_plugin(&package.manifest, &bytes, hc.clone(), &policy)
+            .with_context(|| format!("plugin `{id}` rejected before setup"))?;
+        let config_entry = serde_json::to_string(&ConfigEntryJson::bootstrap(id.as_str()))?;
+        let setup_plugin = plugin.clone();
+        let result = tokio::task::spawn_blocking(move || setup_plugin.call_setup(&config_entry))
+            .await
+            .with_context(|| format!("plugin `{id}` setup task failed"))?
+            .with_context(|| format!("plugin `{id}` setup trapped"))?;
+        if result != 0 {
+            let _ = plugin.call_teardown();
+            teardown_wasm(loaded).await;
+            anyhow::bail!("plugin `{id}` setup returned failure code {result}");
+        }
+        info!(
+            plugin = %id,
+            package = %package.package_dir.display(),
+            "signed WASM plugin loaded"
+        );
+        loaded.push((id, plugin));
+    }
+    Ok(loaded)
+}
+
+#[cfg(feature = "wasmtime")]
+async fn teardown_wasm(plugins: Vec<(PluginId, WasmPlugin)>) {
+    for (_, plugin) in plugins.into_iter().rev() {
+        let _ = tokio::task::spawn_blocking(move || plugin.call_teardown()).await;
+    }
+}

From 5b5c7f323d706f626808c29df946b181105bb3d6 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:30:51 -0400
Subject: [PATCH 08/16] fix(homecore): wire plugin lifecycle and preserve MSRV

---
 v2/Cargo.lock                               | 268 ++++++++++++--------
 v2/crates/homecore-plugins/Cargo.toml       |   3 +-
 v2/crates/homecore-plugins/src/discovery.rs |  18 +-
 v2/crates/homecore-plugins/src/tests.rs     |  11 +-
 v2/crates/homecore-server/src/main.rs       |  33 +++
 v2/crates/homecore-server/src/plugins.rs    |  49 ++--
 6 files changed, 248 insertions(+), 134 deletions(-)

diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index 417f9a75..76f3e3c8 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "addr2line"
-version = "0.26.1"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59317f77929f0e679d39364702289274de2f0f0b22cbf50b2b8cff2169a0b27a"
+checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
 dependencies = [
  "gimli",
 ]
@@ -1266,47 +1266,46 @@ dependencies = [
 
 [[package]]
 name = "cranelift-assembler-x64"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b242b4c3675139f52f0b55624fb92571551a344305c5998f55ad20fa527bc55"
+checksum = "d6abf69c884fde2d9d4cc232a585fb18f16af3ae04c634315c84ebe158ded92d"
 dependencies = [
  "cranelift-assembler-x64-meta",
 ]
 
 [[package]]
 name = "cranelift-assembler-x64-meta"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "499715f19799219f32641b14f2a162f91e50bc1b61c2d2184c2be971716f5c56"
+checksum = "263d31fcdf83a10267e8c38b53bc8f7688dfbc331267fd8fdf5b22e0dc47a55b"
 dependencies = [
  "cranelift-srcgen",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ebca2ea7c62c56feb88a5b23ec380460fe6d7c18134520f6ddf4bfa35cbea68"
+checksum = "d459d5377c01c4472b71029caa2df41afaf47711676aa9b12d7414f15104637b"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe11f154b62d7421d909503a746e89995393b1b71926e6f12b08a2076396d7fb"
+checksum = "8283088d5823ba7856ab8d531b7c3654b24984748f9fd99dcf3210701fd1d065"
 dependencies = [
  "serde",
  "serde_derive",
- "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f2d0da3d51979dc0183fac3076a535477eab794716b063143ecb16632408664"
+checksum = "7d3138316d8dd341d725d6ab1598750545c76ad32892837fde558edd68a01b43"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -1319,7 +1318,6 @@ dependencies = [
  "cranelift-isle",
  "gimli",
  "hashbrown 0.15.5",
- "libm",
  "log",
  "pulley-interpreter",
  "regalloc2",
@@ -1327,14 +1325,14 @@ dependencies = [
  "serde",
  "smallvec",
  "target-lexicon 0.13.5",
- "wasmtime-internal-core",
+ "wasmtime-internal-math",
 ]
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "483b2c94a1b7f6fba0714387ba34ca56d114b2214a80be018acbb2ed40e09a1e"
+checksum = "505cead19304a8dc8689e31b29038775c3f73f9d5ea7a5e33864437a1f46c6b6"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -1345,36 +1343,35 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4aae718c336a52d90d4ebe9a2d8c3cf0906a4bee78f0e6867e777eebbe554fe"
+checksum = "ce62ba94f570644ce7de6ed05bd39ca28936665dec10a2a1f6f2c531d6add45c"
 
 [[package]]
 name = "cranelift-control"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a18e94519070dc56cddb71906a08cea6a28a1d7c58ed501b88f273fa6b45fa07"
+checksum = "db6cfe339689c3926412a7060ab00ef3b2b43d936b537e7a3f696121be9d0eaa"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0ab4e0eff1045ff2f5ddd8195bf3c97d7b5ef9b780cb044e0cce76e4d352057"
+checksum = "625518090e912bdfe3c41464bf97ae421f6044d4ca0f5c3267dcacdb352b033d"
 dependencies = [
  "cranelift-bitset",
  "serde",
  "serde_derive",
- "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7645a236e1ec49e660f09ec9fa979a1c5d0b612c419db7610573d4d58a03b7c"
+checksum = "17f652d40ddf3afb55be64d8979d312b52b384a8cebbcde1dd1c2e32ebcd4466"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -1384,15 +1381,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57e0b4a1a0ea01cc19084ff01aaeb640dfe22905d47d83037a419b81ba587ed0"
+checksum = "9f512767e83015f4baf6e732cabca93cea82907e3ab237f826ef64f7ece75eb6"
 
 [[package]]
 name = "cranelift-native"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bdec40b396eb630ecfb0e7a81766d7287f464a7631b9eb5862f7711f1020012"
+checksum = "cb1ca6e4dca568ff988d367e4707be2362cee9782265b0a501eaf467ffd550a8"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1401,9 +1398,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-srcgen"
-version = "0.129.2"
+version = "0.127.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a1a001a9dc4557d9e2be324bc932621c0aa9bf33b74dfefa2338f0bf8913329"
+checksum = "97400ad8fbd3a434092fc0b486fa7784150b53187941d818b1087f3ac0a547f0"
 
 [[package]]
 name = "crc"
@@ -2185,6 +2182,12 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
 [[package]]
 name = "fastbloom"
 version = "0.14.1"
@@ -3102,12 +3105,11 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.33.0"
+version = "0.32.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bf7f043f89559805f8c7cacc432749b2fa0d0a0a9ee46ce47164ed5ba7f126c"
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 dependencies = [
- "fnv",
- "hashbrown 0.16.1",
+ "fallible-iterator",
  "indexmap 2.13.0",
  "stable_deref_trait",
 ]
@@ -6402,21 +6404,21 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e59a11b64c166a6e1e990303f46a255a52fb4e84d175dbd5e5ca0428e8c02ce"
+checksum = "5de307c194cf6310d486dd5595ffc329c53b4acafd54e214752c1eb2e68be3a9"
 dependencies = [
  "cranelift-bitset",
  "log",
  "pulley-macros",
- "wasmtime-internal-core",
+ "wasmtime-internal-math",
 ]
 
 [[package]]
 name = "pulley-macros"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "823a9d8da391be21a5f4d5e11c39d15f45b011076c6825fc2323f7e4753f09ce"
+checksum = "99dca2747e910d10bafe911e172a1b35860268421c3ee5ddb7e16c35e0288b4a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -10475,9 +10477,9 @@ checksum = "cfe29135b180b72b04c74aa97b2b4a2ef275161eff9a6c7955ea9eaedc7e1d4e"
 
 [[package]]
 name = "wasm-compose"
-version = "0.244.0"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92cda9c76ca8dcac01a8b497860c2cb15cd6f216dc07060517df5abbe82512ac"
+checksum = "af801b6f36459023eaec63fdbaedad2fd5a4ab7dc74ecc110a8b5d375c5775e4"
 dependencies = [
  "anyhow",
  "heck 0.5.0",
@@ -10489,11 +10491,21 @@ dependencies = [
  "serde_derive",
  "serde_yaml",
  "smallvec",
- "wasm-encoder 0.244.0",
- "wasmparser 0.244.0",
+ "wasm-encoder 0.243.0",
+ "wasmparser 0.243.0",
  "wat",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.243.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c55db9c896d70bd9fa535ce83cd4e1f2ec3726b0edd2142079f594fc3be1cb35"
+dependencies = [
+ "leb128fmt",
+ "wasmparser 0.243.0",
+]
+
 [[package]]
 name = "wasm-encoder"
 version = "0.244.0"
@@ -10571,6 +10583,19 @@ dependencies = [
  "shlex 0.1.1",
 ]
 
+[[package]]
+name = "wasmparser"
+version = "0.243.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6d8db401b0528ec316dfbe579e6ab4152d61739cfe076706d2009127970159d"
+dependencies = [
+ "bitflags 2.11.0",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.0",
+ "semver",
+ "serde",
+]
+
 [[package]]
 name = "wasmparser"
 version = "0.244.0"
@@ -10581,7 +10606,6 @@ dependencies = [
  "hashbrown 0.15.5",
  "indexmap 2.13.0",
  "semver",
- "serde",
 ]
 
 [[package]]
@@ -10597,22 +10621,23 @@ dependencies = [
 
 [[package]]
 name = "wasmprinter"
-version = "0.244.0"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09390d7b2bd7b938e563e4bff10aa345ef2e27a3bc99135697514ef54495e68f"
+checksum = "eb2b6035559e146114c29a909a3232928ee488d6507a1504d8934e8607b36d7b"
 dependencies = [
  "anyhow",
  "termcolor",
- "wasmparser 0.244.0",
+ "wasmparser 0.243.0",
 ]
 
 [[package]]
 name = "wasmtime"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66806cf6094768e227f74d209eb017cc967276c94fea478e62a0dffede2b3d0d"
+checksum = "0702b64d4c3fe43ae4ce229e06af06a27783e48c519e68586d180717cdd24314"
 dependencies = [
  "addr2line",
+ "anyhow",
  "async-trait",
  "bitflags 2.11.0",
  "bumpalo",
@@ -10622,6 +10647,8 @@ dependencies = [
  "futures",
  "fxprof-processed-profile",
  "gimli",
+ "hashbrown 0.15.5",
+ "indexmap 2.13.0",
  "ittapi",
  "libc",
  "log",
@@ -10641,17 +10668,18 @@ dependencies = [
  "target-lexicon 0.13.5",
  "tempfile",
  "wasm-compose",
- "wasm-encoder 0.244.0",
- "wasmparser 0.244.0",
+ "wasm-encoder 0.243.0",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
  "wasmtime-internal-cache",
  "wasmtime-internal-component-macro",
  "wasmtime-internal-component-util",
- "wasmtime-internal-core",
  "wasmtime-internal-cranelift",
  "wasmtime-internal-fiber",
  "wasmtime-internal-jit-debug",
  "wasmtime-internal-jit-icache-coherence",
+ "wasmtime-internal-math",
+ "wasmtime-internal-slab",
  "wasmtime-internal-unwinder",
  "wasmtime-internal-versioned-export-macros",
  "wasmtime-internal-winch",
@@ -10661,16 +10689,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-environ"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90d3611be7991cba09f14dbb99fe7a0fbaca9eb995ab5c548456eeda44afe20e"
+checksum = "3ffeb777a21965a85e4b1ce7b308c63ba130df91912096b49b95523bf3bdd2c7"
 dependencies = [
  "anyhow",
  "cpp_demangle",
  "cranelift-bitset",
  "cranelift-entity",
  "gimli",
- "hashbrown 0.15.5",
  "indexmap 2.13.0",
  "log",
  "object",
@@ -10681,19 +10708,19 @@ dependencies = [
  "serde_derive",
  "smallvec",
  "target-lexicon 0.13.5",
- "wasm-encoder 0.244.0",
- "wasmparser 0.244.0",
+ "wasm-encoder 0.243.0",
+ "wasmparser 0.243.0",
  "wasmprinter",
  "wasmtime-internal-component-util",
- "wasmtime-internal-core",
 ]
 
 [[package]]
 name = "wasmtime-internal-cache"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2407af12566ff8d537b1a978eccaa087cc4c6d1f13fa57d21114a8def8bfe8a3"
+checksum = "bf419cf9b748d443be7aead0fc85c36dcdfdb4bbbd8203b3cf47179d6de4b0dd"
 dependencies = [
+ "anyhow",
  "base64 0.22.1",
  "directories-next",
  "log",
@@ -10703,16 +10730,15 @@ dependencies = [
  "serde_derive",
  "sha2",
  "toml 0.9.12+spec-1.1.0",
- "wasmtime-environ",
  "windows-sys 0.61.2",
  "zstd 0.13.3",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3616cebe594e6c4b573ddb908d2703d13b53b2abdaeb73acd1ca8b5a911bc256"
+checksum = "935bb8db1e2829bf26b80ed3daeed6cf9fc804f7002c90a8d17dbd5e93c69e0b"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -10720,31 +10746,22 @@ dependencies = [
  "syn 2.0.117",
  "wasmtime-internal-component-util",
  "wasmtime-internal-wit-bindgen",
- "wit-parser",
+ "wit-parser 0.243.0",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61571112f9cbf9798e48f3bd6ba5161588a08b99158585153784e3f46f955053"
-
-[[package]]
-name = "wasmtime-internal-core"
-version = "42.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be7c68311d6220c20cefdf334e0c8021e16a050383c67edc5be42e5661ddf265"
-dependencies = [
- "anyhow",
- "libm",
-]
+checksum = "52625d0c8fe2df1d7dd96d45d37dae8818c183c183a82b2368e3741ee5253859"
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c5fd90a9113379260508193bab9f4e870d34078fdd181f9fc8dd053b0f7a958c"
+checksum = "85da1ba5fee01a3ee21c4d0c8052cc9035388639fa091a969b534d4c6f8449d4"
 dependencies = [
+ "anyhow",
  "cfg-if",
  "cranelift-codegen",
  "cranelift-control",
@@ -10759,33 +10776,33 @@ dependencies = [
  "smallvec",
  "target-lexicon 0.13.5",
  "thiserror 2.0.18",
- "wasmparser 0.244.0",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
- "wasmtime-internal-core",
+ "wasmtime-internal-math",
  "wasmtime-internal-unwinder",
  "wasmtime-internal-versioned-export-macros",
 ]
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbd95ecd37e62eaae686256ca9773902b73c0398c2eb8cfbca49fbf950609c22"
+checksum = "a4c7de5a0872764c1ca640886af10a70cf7f8526386906245b43cdb345ece0e6"
 dependencies = [
+ "anyhow",
  "cc",
  "cfg-if",
  "libc",
  "rustix",
- "wasmtime-environ",
  "wasmtime-internal-versioned-export-macros",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b875a7727c043a308c81f2de5ce7260b7513cb5baaa2af32937646b8c9019a3f"
+checksum = "160acd973d770d62bef1b2697d7fac83a8fe63ef966215e624382b2a9532bd58"
 dependencies = [
  "cc",
  "object",
@@ -10795,34 +10812,49 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52c0779e711777b915d017b3f54049e658057a77df99e0e7958406b3c5d7d07"
+checksum = "cc57f590ba7ea967ea9e8c8560175c6926e5b15d11c29bbde3ad0013a29470eb"
 dependencies = [
+ "anyhow",
  "cfg-if",
  "libc",
- "wasmtime-internal-core",
  "windows-sys 0.61.2",
 ]
 
 [[package]]
-name = "wasmtime-internal-unwinder"
-version = "42.0.2"
+name = "wasmtime-internal-math"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acb031b1e9700667b3f818235b2846e3babeb30bc340c8233d3fad4c44d80ff"
+checksum = "07612904518d47b677e8db67ca47c16d8c8cefb0099020729f886776950cb58b"
 dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "wasmtime-internal-slab"
+version = "40.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc83ff16531e1e1537e0de2b630af56a0a9e1fab864130c5b7e213da71783a0f"
+
+[[package]]
+name = "wasmtime-internal-unwinder"
+version = "40.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47371d697244785e4bbb371229f9a2daa8628d1e03368ec895cf658370e1bf38"
+dependencies = [
+ "anyhow",
  "cfg-if",
  "cranelift-codegen",
  "log",
  "object",
- "wasmtime-environ",
 ]
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbfbbfdb0cfd638145b0de4d3e309901ccc4e29965a33ca1eb18ab6f37057350"
+checksum = "ad3cd4aff8f2e7ec658c7a0424b74ad88a6940505303fb0616323592a1c400a6"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -10831,16 +10863,17 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-winch"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f4853af4a25f98c039cc27c7238e40df9ec783fc7981b879a813153d1d3211a"
+checksum = "fc4d1e6a37b397aa0a16b3b7f3a48f317d73c81ac7801be1fa9a135f30c55421"
 dependencies = [
+ "anyhow",
  "cranelift-codegen",
  "gimli",
  "log",
  "object",
  "target-lexicon 0.13.5",
- "wasmparser 0.244.0",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
  "wasmtime-internal-cranelift",
  "winch-codegen",
@@ -10848,15 +10881,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de1c8eaa54b17e3a64b6c0cfabd065bdbdfd06f5d7c685272b7309117377be0"
+checksum = "73a5774737acccdc70ff27bbe9e09c45b156bd7792bb83906735a572ce122247"
 dependencies = [
  "anyhow",
  "bitflags 2.11.0",
  "heck 0.5.0",
  "indexmap 2.13.0",
- "wit-parser",
+ "wit-parser 0.243.0",
 ]
 
 [[package]]
@@ -11515,10 +11548,11 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "42.0.2"
+version = "40.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d1bc7cbb9103e6847042f0514f911126263173f6e9a18e5cfa257d3b5711c09"
+checksum = "dcca3ffe030cc6fe77f2055c19d850bcb2c2589fa6ddc7a8ebb446f7c2b1e715"
 dependencies = [
+ "anyhow",
  "cranelift-assembler-x64",
  "cranelift-codegen",
  "gimli",
@@ -11526,10 +11560,10 @@ dependencies = [
  "smallvec",
  "target-lexicon 0.13.5",
  "thiserror 2.0.18",
- "wasmparser 0.244.0",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
- "wasmtime-internal-core",
  "wasmtime-internal-cranelift",
+ "wasmtime-internal-math",
 ]
 
 [[package]]
@@ -12135,7 +12169,7 @@ checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
 dependencies = [
  "anyhow",
  "heck 0.5.0",
- "wit-parser",
+ "wit-parser 0.244.0",
 ]
 
 [[package]]
@@ -12185,7 +12219,25 @@ dependencies = [
  "wasm-encoder 0.244.0",
  "wasm-metadata",
  "wasmparser 0.244.0",
- "wit-parser",
+ "wit-parser 0.244.0",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.243.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df983a8608e513d8997f435bb74207bf0933d0e49ca97aa9d8a6157164b9b7fc"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.13.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser 0.243.0",
 ]
 
 [[package]]
diff --git a/v2/crates/homecore-plugins/Cargo.toml b/v2/crates/homecore-plugins/Cargo.toml
index 7c4b23a1..e20c940a 100644
--- a/v2/crates/homecore-plugins/Cargo.toml
+++ b/v2/crates/homecore-plugins/Cargo.toml
@@ -62,7 +62,8 @@ base64 = "0.22"
 # Optional Wasmtime runtime (P2, default-off — 30 MB dep).
 # Bumped from 25.0.3 → 42 to remediate RUSTSEC-2026-0095 and RUSTSEC-2026-0096
 # (Cranelift/Winch sandbox-escape CVEs, CVSS 9.0 — iter-11 security sprint HC-03/04).
-wasmtime = { version = "42", optional = true }
+# v40 is the newest line compatible with HOMECORE's Rust 1.89 MSRV.
+wasmtime = { version = "40.0.4", optional = true }
 
 # Optional wasm3 interpretation runtime (P3, default-off).
 wasm3 = { version = "0.3", optional = true }
diff --git a/v2/crates/homecore-plugins/src/discovery.rs b/v2/crates/homecore-plugins/src/discovery.rs
index bfa8454d..f8d134d4 100644
--- a/v2/crates/homecore-plugins/src/discovery.rs
+++ b/v2/crates/homecore-plugins/src/discovery.rs
@@ -115,10 +115,7 @@ pub fn discover_plugins(
         let manifest_bytes =
             bounded_regular_file(&manifest_path, limits.max_manifest_bytes, "manifest")?;
         let manifest_text = std::str::from_utf8(&manifest_bytes).map_err(|e| {
-            PluginError::InvalidManifest(format!(
-                "{} is not UTF-8: {e}",
-                manifest_path.display()
-            ))
+            PluginError::InvalidManifest(format!("{} is not UTF-8: {e}", manifest_path.display()))
         })?;
         let manifest = PluginManifest::parse_json(manifest_text)?;
         if !domains.insert(manifest.domain.clone()) {
@@ -235,9 +232,13 @@ mod tests {
         let root = root();
         package(&root, "z-last", "zeta", "z.wasm");
         package(&root, "a-first", "alpha", "a.wasm");
-        let found = discover_plugins(&[root.clone()], DiscoveryLimits::default()).unwrap();
+        let found =
+            discover_plugins(std::slice::from_ref(&root), DiscoveryLimits::default()).unwrap();
         assert_eq!(
-            found.iter().map(|p| p.manifest.domain.as_str()).collect::<Vec<_>>(),
+            found
+                .iter()
+                .map(|p| p.manifest.domain.as_str())
+                .collect::<Vec<_>>(),
             ["alpha", "zeta"]
         );
         fs::remove_dir_all(root).unwrap();
@@ -247,7 +248,8 @@ mod tests {
     fn traversal_module_path_is_rejected() {
         let root = root();
         package(&root, "bad", "bad", "../bad.wasm");
-        let error = discover_plugins(&[root.clone()], DiscoveryLimits::default()).unwrap_err();
+        let error =
+            discover_plugins(std::slice::from_ref(&root), DiscoveryLimits::default()).unwrap_err();
         assert!(matches!(error, PluginError::InvalidManifest(_)));
         fs::remove_dir_all(root).unwrap();
     }
@@ -257,7 +259,7 @@ mod tests {
         let root = root();
         package(&root, "large", "large", "large.wasm");
         let error = discover_plugins(
-            &[root.clone()],
+            std::slice::from_ref(&root),
             DiscoveryLimits {
                 max_module_bytes: 4,
                 ..DiscoveryLimits::default()
diff --git a/v2/crates/homecore-plugins/src/tests.rs b/v2/crates/homecore-plugins/src/tests.rs
index de20cd50..2784bf13 100644
--- a/v2/crates/homecore-plugins/src/tests.rs
+++ b/v2/crates/homecore-plugins/src/tests.rs
@@ -5,6 +5,7 @@
 //! and PluginError variants.
 
 #[cfg(test)]
+#[allow(clippy::module_inception)]
 mod tests {
     use std::sync::Arc;
 
@@ -144,7 +145,10 @@ mod tests {
             .expect("load should succeed");
 
         assert_eq!(id.as_str(), "lights");
-        assert!(*plugin.setup_called.lock().await, "setup should have been called");
+        assert!(
+            *plugin.setup_called.lock().await,
+            "setup should have been called"
+        );
 
         let listing = registry.list().await;
         assert_eq!(listing.len(), 1);
@@ -163,7 +167,10 @@ mod tests {
             .expect("load should succeed");
 
         registry.unload(&id).await.expect("unload should succeed");
-        assert!(*plugin.unload_called.lock().await, "unload should have been called");
+        assert!(
+            *plugin.unload_called.lock().await,
+            "unload should have been called"
+        );
         assert_eq!(registry.list().await.len(), 0);
     }
 
diff --git a/v2/crates/homecore-server/src/main.rs b/v2/crates/homecore-server/src/main.rs
index 2396a4f3..0f79faea 100644
--- a/v2/crates/homecore-server/src/main.rs
+++ b/v2/crates/homecore-server/src/main.rs
@@ -37,6 +37,7 @@ use tower_http::services::ServeDir;
 use tower_http::trace::TraceLayer;
 
 mod gateway;
+mod plugins;
 mod restore;
 use gateway::{GatewayConfig, GatewayState};
 
@@ -116,6 +117,26 @@ struct Cli {
     /// Optional Home Assistant-style automations YAML file to load at boot.
     #[arg(long, env = "HOMECORE_AUTOMATIONS")]
     automations: Option<std::path::PathBuf>,
+
+    /// Explicit directories containing packaged WebAssembly plugins.
+    #[arg(
+        long = "plugin-dir",
+        env = "HOMECORE_PLUGIN_DIRS",
+        value_delimiter = ','
+    )]
+    plugin_dirs: Vec<std::path::PathBuf>,
+
+    /// Base64 Ed25519 publisher keys trusted to sign WebAssembly packages.
+    #[arg(
+        long = "plugin-trusted-publisher",
+        env = "HOMECORE_PLUGIN_TRUSTED_PUBLISHERS",
+        value_delimiter = ','
+    )]
+    plugin_trusted_publishers: Vec<String>,
+
+    /// Permit unsigned WebAssembly plugins. Unsafe; development only.
+    #[arg(long, env = "HOMECORE_PLUGIN_ALLOW_UNSIGNED", default_value_t = false)]
+    plugin_allow_unsigned: bool,
 }
 
 #[tokio::main]
@@ -206,6 +227,17 @@ async fn main() -> Result<()> {
     }
 
     // ── 3. Plugin runtime ───────────────────────────────────────────
+    let server_plugins = plugins::ServerPlugins::start(
+        hc.clone(),
+        plugins::PluginConfig {
+            directories: cli.plugin_dirs.clone(),
+            trusted_publishers: cli.plugin_trusted_publishers.clone(),
+            allow_unsigned: cli.plugin_allow_unsigned,
+            limits: homecore_plugins::DiscoveryLimits::default(),
+        },
+    )
+    .await?;
+
     // ── 4. Automation engine ────────────────────────────────────────
     // Construct AND start the engine (HC-WS-03, ADR-161). `start()`
     // spawns the state-change event loop + the 1 Hz wall-clock timer
@@ -302,6 +334,7 @@ async fn main() -> Result<()> {
             info!("Shutdown requested; draining active HTTP connections");
         })
         .await?;
+    server_plugins.shutdown().await;
     Ok(())
 }
 
diff --git a/v2/crates/homecore-server/src/plugins.rs b/v2/crates/homecore-server/src/plugins.rs
index 5693921f..a336c080 100644
--- a/v2/crates/homecore-server/src/plugins.rs
+++ b/v2/crates/homecore-server/src/plugins.rs
@@ -10,8 +10,8 @@ use std::sync::Arc;
 use anyhow::{Context as _, Result};
 use homecore::HomeCore;
 use homecore_plugins::{
-    DiscoveryLimits, HomeCorePlugin, InProcessRuntime, PluginError, PluginManifest,
-    PluginRegistry, StateChangedEventJson,
+    DiscoveryLimits, HomeCorePlugin, InProcessRuntime, PluginError, PluginManifest, PluginRegistry,
+    StateChangedEventJson,
 };
 use tokio::task::JoinHandle;
 use tracing::{error, info, warn};
@@ -22,9 +22,10 @@ use homecore_plugins::{
 };
 
 /// Factory entry for a trusted plugin linked into the server at compile time.
+type NativePluginFactory = fn() -> Result<(PluginManifest, Arc<dyn HomeCorePlugin>), PluginError>;
+
 pub struct NativePluginRegistration {
-    pub create:
-        fn() -> Result<(PluginManifest, Arc<dyn HomeCorePlugin>), PluginError>,
+    pub create: NativePluginFactory,
 }
 
 /// This is intentionally empty in the generic server. Appliance builds can
@@ -36,6 +37,7 @@ pub struct PluginConfig {
     pub directories: Vec<PathBuf>,
     pub trusted_publishers: Vec<String>,
     pub allow_unsigned: bool,
+    #[cfg_attr(not(feature = "wasmtime"), allow(dead_code))]
     pub limits: DiscoveryLimits,
 }
 
@@ -52,8 +54,8 @@ impl ServerPlugins {
     pub async fn start(hc: HomeCore, config: PluginConfig) -> Result<Self> {
         let native = Arc::new(PluginRegistry::new(InProcessRuntime));
         for registration in NATIVE_PLUGINS {
-            let (manifest, plugin) = (registration.create)()
-                .context("compiled-in native plugin factory failed")?;
+            let (manifest, plugin) =
+                (registration.create)().context("compiled-in native plugin factory failed")?;
             native
                 .load(manifest, plugin, hc.clone())
                 .await
@@ -87,7 +89,10 @@ impl ServerPlugins {
                 let change = match receiver.recv().await {
                     Ok(change) => change,
                     Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {
-                        warn!(skipped, "plugin state dispatcher lagged; events were dropped");
+                        warn!(
+                            skipped,
+                            "plugin state dispatcher lagged; events were dropped"
+                        );
                         continue;
                     }
                     Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
@@ -106,7 +111,10 @@ impl ServerPlugins {
                 }
                 #[cfg(feature = "wasmtime")]
                 for (id, plugin) in &dispatch_wasm {
-                    if !plugin.subscriptions().iter().any(|entity| entity == change.entity_id.as_str())
+                    if !plugin
+                        .subscriptions()
+                        .iter()
+                        .any(|entity| entity == change.entity_id.as_str())
                     {
                         continue;
                     }
@@ -117,23 +125,30 @@ impl ServerPlugins {
                         event.new_state.as_deref(),
                         event.attributes.clone(),
                     );
-                    match tokio::task::spawn_blocking(move || plugin.call_state_changed(&event)).await
+                    match tokio::task::spawn_blocking(move || plugin.call_state_changed(&event))
+                        .await
                     {
                         Ok(Ok(0)) => {}
-                        Ok(Ok(code)) => error!(plugin = %id, code, "WASM state_changed returned failure"),
-                        Ok(Err(error)) => error!(plugin = %id, %error, "WASM state_changed trapped"),
+                        Ok(Ok(code)) => {
+                            error!(plugin = %id, code, "WASM state_changed returned failure")
+                        }
+                        Ok(Err(error)) => {
+                            error!(plugin = %id, %error, "WASM state_changed trapped")
+                        }
                         Err(error) => error!(plugin = %id, %error, "WASM dispatch task failed"),
                     }
                 }
             }
         });
 
+        #[cfg(feature = "wasmtime")]
         info!(
             native = NATIVE_PLUGINS.len(),
-            #[cfg(feature = "wasmtime")]
             wasm = wasm.len(),
             "plugin subsystem started"
         );
+        #[cfg(not(feature = "wasmtime"))]
+        info!(native = NATIVE_PLUGINS.len(), "plugin subsystem started");
         Ok(Self {
             native,
             dispatcher,
@@ -171,11 +186,15 @@ async fn load_wasm_plugins(
         warn!("INSECURE plugin policy enabled: unsigned plugins may execute");
         PluginPolicy::AllowUnsigned
     } else {
-        let keys: Vec<_> = config.trusted_publishers.iter().map(String::as_str).collect();
+        let keys: Vec<_> = config
+            .trusted_publishers
+            .iter()
+            .map(String::as_str)
+            .collect();
         PluginPolicy::trusted(&keys).context("invalid trusted plugin publisher key")?
     };
-    let discovered = discover_plugins(&config.directories, config.limits)
-        .context("plugin discovery failed")?;
+    let discovered =
+        discover_plugins(&config.directories, config.limits).context("plugin discovery failed")?;
     let runtime = WasmtimeRuntime::new().context("Wasmtime initialization failed")?;
     let mut loaded: Vec<(PluginId, WasmPlugin)> = Vec::with_capacity(discovered.len());
     for package in discovered {

From fbd5cfa2420d4a6142efbd17fd802e83a0c8e424 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:41:25 -0400
Subject: [PATCH 09/16] feat(homecore-server): wire HAP runtime and registry
 APIs

---
 v2/Cargo.lock                                |   1 +
 v2/crates/homecore-api/src/rest.rs           |   7 +-
 v2/crates/homecore-api/src/ws.rs             |  18 +++
 v2/crates/homecore-api/tests/ws_handshake.rs |  49 ++++++
 v2/crates/homecore-server/Cargo.toml         |   3 +
 v2/crates/homecore-server/src/hap.rs         | 160 +++++++++++++++++++
 v2/crates/homecore-server/src/main.rs        |  48 ++++++
 v2/docs/homecore-capabilities.md             |  81 ++++++----
 8 files changed, 337 insertions(+), 30 deletions(-)
 create mode 100644 v2/crates/homecore-server/src/hap.rs

diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index 76f3e3c8..cb875c09 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -3681,6 +3681,7 @@ dependencies = [
  "homecore-api",
  "homecore-assist",
  "homecore-automation",
+ "homecore-hap",
  "homecore-migrate",
  "homecore-plugins",
  "homecore-recorder",
diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index 5f60576e..e576415e 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -382,7 +382,12 @@ pub async fn compatibility(
             "events": "implemented",
             "render_template": "implemented",
             "feature_negotiation_and_panels": "implemented",
-            "registries": "requires_registry_backend",
+            "registry_lists": {
+                "entity": "implemented",
+                "device": "implemented",
+                "area": "implemented_empty",
+                "mutations": "requires_persistent_registry_backend"
+            },
             "lovelace_media": "integration_dependent"
         }
     })))
diff --git a/v2/crates/homecore-api/src/ws.rs b/v2/crates/homecore-api/src/ws.rs
index b1c3c2b0..38cf3df7 100644
--- a/v2/crates/homecore-api/src/ws.rs
+++ b/v2/crates/homecore-api/src/ws.rs
@@ -284,6 +284,24 @@ impl Connection {
                 let payload = serde_json::to_value(by_domain).unwrap();
                 self.ack(tx, cmd.id, true, Some(payload));
             }
+            "config/entity_registry/list" | "get_entity_registry" => {
+                let entries = self.state.homecore().entities().all().await;
+                let payload =
+                    serde_json::to_value(entries).unwrap_or_else(|_| serde_json::json!([]));
+                self.ack(tx, cmd.id, true, Some(payload));
+            }
+            "config/device_registry/list" | "get_device_registry" => {
+                let entries = self.state.homecore().devices().all().await;
+                let payload =
+                    serde_json::to_value(entries).unwrap_or_else(|_| serde_json::json!([]));
+                self.ack(tx, cmd.id, true, Some(payload));
+            }
+            "config/area_registry/list" | "get_area_registry" => {
+                // HOMECORE does not yet model named areas. Returning the valid
+                // empty-list shape lets clients distinguish that from an
+                // unsupported command.
+                self.ack(tx, cmd.id, true, Some(serde_json::json!([])));
+            }
             "call_service" => {
                 let (Some(domain), Some(service)) = (cmd.domain.clone(), cmd.service.clone())
                 else {
diff --git a/v2/crates/homecore-api/tests/ws_handshake.rs b/v2/crates/homecore-api/tests/ws_handshake.rs
index bdbaf399..24a6b372 100644
--- a/v2/crates/homecore-api/tests/ws_handshake.rs
+++ b/v2/crates/homecore-api/tests/ws_handshake.rs
@@ -338,3 +338,52 @@ async fn real_state_change_uses_client_subscription_id() {
     assert_eq!(unsub["id"], 42);
     assert_eq!(unsub["success"], true);
 }
+
+#[tokio::test]
+async fn registry_list_commands_return_ha_result_shapes() {
+    use homecore::{EntityEntry, EntityId};
+
+    let (addr, hc) = spawn_server_returning_homecore("good_token_abc").await;
+    hc.entities()
+        .register(EntityEntry {
+            entity_id: EntityId::parse("light.registry_probe").unwrap(),
+            unique_id: Some("probe-1".into()),
+            platform: "test".into(),
+            name: Some("Registry probe".into()),
+            disabled_by: None,
+            area_id: None,
+            device_id: None,
+            entity_category: None,
+            config_entry_id: None,
+        })
+        .await;
+
+    let url = format!("ws://{addr}/api/websocket");
+    let (mut ws, _response) = connect_async(&url).await.unwrap();
+    let _ = next_json(&mut ws).await;
+    ws.send(Message::Text(
+        serde_json::json!({"type":"auth","access_token":"good_token_abc"}).to_string(),
+    ))
+    .await
+    .unwrap();
+    let _ = next_json(&mut ws).await;
+
+    for (id, command) in [
+        (71, "config/entity_registry/list"),
+        (72, "config/device_registry/list"),
+        (73, "config/area_registry/list"),
+    ] {
+        ws.send(Message::Text(
+            serde_json::json!({"id": id, "type": command}).to_string(),
+        ))
+        .await
+        .unwrap();
+        let reply = next_json(&mut ws).await;
+        assert_eq!(reply["id"], id);
+        assert_eq!(reply["success"], true);
+        assert!(reply["result"].is_array());
+        if command == "config/entity_registry/list" {
+            assert_eq!(reply["result"][0]["entity_id"], "light.registry_probe");
+        }
+    }
+}
diff --git a/v2/crates/homecore-server/Cargo.toml b/v2/crates/homecore-server/Cargo.toml
index 0bb62d61..47fe8bb2 100644
--- a/v2/crates/homecore-server/Cargo.toml
+++ b/v2/crates/homecore-server/Cargo.toml
@@ -29,6 +29,7 @@ homecore-recorder  = { path = "../homecore-recorder",  version = "0.1.0-alpha.0"
 homecore-migrate   = { path = "../homecore-migrate",   version = "0.1.0-alpha.0" }
 homecore-automation = { path = "../homecore-automation", version = "0.1.0-alpha.0" }
 homecore-assist    = { path = "../homecore-assist",    version = "0.1.0-alpha.0" }
+homecore-hap       = { path = "../homecore-hap",       version = "0.1.0-alpha.0", optional = true }
 
 tokio = { version = "1", features = ["full"] }
 tracing = "0.1"
@@ -66,3 +67,5 @@ default = []
 ruvector = ["homecore-recorder/ruvector"]
 # Pull in real Wasmtime plugin runtime (vs InProcessRuntime).
 wasmtime = ["homecore-plugins/wasmtime"]
+# Bind the HAP TCP listener and publish `_hap._tcp` over mDNS.
+hap-server = ["dep:homecore-hap", "homecore-hap/hap-server"]
diff --git a/v2/crates/homecore-server/src/hap.rs b/v2/crates/homecore-server/src/hap.rs
new file mode 100644
index 00000000..61df950e
--- /dev/null
+++ b/v2/crates/homecore-server/src/hap.rs
@@ -0,0 +1,160 @@
+//! Optional network HomeKit Accessory Protocol lifecycle.
+
+use std::net::{IpAddr, SocketAddr};
+use std::path::PathBuf;
+
+use anyhow::Result;
+use homecore::HomeCore;
+
+#[derive(Debug, Clone)]
+#[cfg_attr(not(feature = "hap-server"), allow(dead_code))]
+pub(crate) struct HapRuntimeConfig {
+    pub bind_addr: Option<SocketAddr>,
+    pub device_id: Option<String>,
+    pub advertise_addr: Option<IpAddr>,
+    pub hostname: String,
+    pub instance_name: String,
+    pub pairing_store: PathBuf,
+}
+
+pub(crate) struct HapRuntime {
+    #[cfg(feature = "hap-server")]
+    handle: Option<homecore_hap::HapServerHandle>,
+    #[cfg(feature = "hap-server")]
+    state_task: Option<tokio::task::JoinHandle<()>>,
+}
+
+impl HapRuntime {
+    pub(crate) async fn shutdown(self) -> Result<()> {
+        #[cfg(feature = "hap-server")]
+        {
+            let mut runtime = self;
+            if let Some(task) = runtime.state_task.take() {
+                task.abort();
+                let _ = task.await;
+            }
+            if let Some(handle) = runtime.handle.take() {
+                handle.shutdown().await?;
+            }
+        }
+        Ok(())
+    }
+}
+
+pub(crate) async fn start(hc: &HomeCore, config: HapRuntimeConfig) -> Result<HapRuntime> {
+    let Some(bind_addr) = config.bind_addr else {
+        tracing::info!("HAP network server disabled");
+        return Ok(HapRuntime {
+            #[cfg(feature = "hap-server")]
+            handle: None,
+            #[cfg(feature = "hap-server")]
+            state_task: None,
+        });
+    };
+
+    #[cfg(not(feature = "hap-server"))]
+    {
+        let _ = (hc, bind_addr);
+        anyhow::bail!(
+            "HAP was requested but this binary was built without the `hap-server` feature"
+        );
+    }
+
+    #[cfg(feature = "hap-server")]
+    {
+        use std::sync::Arc;
+
+        use homecore_hap::{
+            start_server, HapBridge, HapServerConfig, HapServiceRecord, MdnsSdAdvertiser,
+            PairingStore,
+        };
+
+        let device_id = config
+            .device_id
+            .as_deref()
+            .ok_or_else(|| anyhow::anyhow!("--hap-device-id is required when HAP is enabled"))?;
+        let advertise_addr = config.advertise_addr.ok_or_else(|| {
+            anyhow::anyhow!("--hap-advertise-addr is required when HAP is enabled")
+        })?;
+        if let Some(parent) = config.pairing_store.parent() {
+            std::fs::create_dir_all(parent)?;
+        }
+
+        let advertiser = Arc::new(MdnsSdAdvertiser::new(
+            config.hostname.clone(),
+            advertise_addr,
+        )?);
+        let pairings = Arc::new(PairingStore::open(&config.pairing_store)?);
+        let record =
+            HapServiceRecord::bridge(config.instance_name.clone(), bind_addr.port(), device_id);
+        let bridge = HapBridge::new(record);
+
+        let mut state_rx = hc.states().subscribe();
+        synchronize(&bridge, hc);
+        let sync_bridge = bridge.clone();
+        let sync_hc = hc.clone();
+        let state_task = tokio::spawn(async move {
+            loop {
+                match state_rx.recv().await {
+                    Ok(change) => match change.new_state {
+                        Some(state) => {
+                            if sync_bridge
+                                .update_accessory(&change.entity_id, &state)
+                                .is_err()
+                            {
+                                let _ = sync_bridge.add_accessory(&change.entity_id, &state);
+                            }
+                        }
+                        None => {
+                            let _ = sync_bridge.remove_accessory(&change.entity_id);
+                        }
+                    },
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(skipped)) => {
+                        tracing::warn!(
+                            skipped,
+                            "HAP state listener lagged; rebuilding accessory snapshot"
+                        );
+                        synchronize(&sync_bridge, &sync_hc);
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+                }
+            }
+        });
+
+        let handle = start_server(
+            HapServerConfig {
+                bind_addr,
+                ..HapServerConfig::default()
+            },
+            bridge,
+            pairings,
+            advertiser,
+        )
+        .await?;
+        tracing::info!(
+            address = %handle.local_addr(),
+            pairing_store = %config.pairing_store.display(),
+            "HAP network server and mDNS advertisement started"
+        );
+        Ok(HapRuntime {
+            handle: Some(handle),
+            state_task: Some(state_task),
+        })
+    }
+}
+
+#[cfg(feature = "hap-server")]
+fn synchronize(bridge: &homecore_hap::HapBridge, hc: &HomeCore) {
+    for accessory in bridge.running_accessories() {
+        let _ = bridge.remove_accessory(&accessory.entity_id);
+    }
+    for state in hc.states().all() {
+        if let Err(error) = bridge.add_accessory(&state.entity_id, &state) {
+            tracing::debug!(
+                entity = %state.entity_id,
+                %error,
+                "entity is not exposed through HAP"
+            );
+        }
+    }
+}
diff --git a/v2/crates/homecore-server/src/main.rs b/v2/crates/homecore-server/src/main.rs
index 0f79faea..f5037fec 100644
--- a/v2/crates/homecore-server/src/main.rs
+++ b/v2/crates/homecore-server/src/main.rs
@@ -37,6 +37,7 @@ use tower_http::services::ServeDir;
 use tower_http::trace::TraceLayer;
 
 mod gateway;
+mod hap;
 mod plugins;
 mod restore;
 use gateway::{GatewayConfig, GatewayState};
@@ -137,6 +138,40 @@ struct Cli {
     /// Permit unsigned WebAssembly plugins. Unsafe; development only.
     #[arg(long, env = "HOMECORE_PLUGIN_ALLOW_UNSIGNED", default_value_t = false)]
     plugin_allow_unsigned: bool,
+
+    /// Bind address for the optional HomeKit Accessory Protocol server.
+    /// The server remains disabled unless this option is supplied.
+    #[arg(long, env = "HOMECORE_HAP_BIND")]
+    hap_bind: Option<SocketAddr>,
+
+    /// Stable six-octet HAP accessory identifier (for example
+    /// `AA:BB:CC:DD:EE:FF`). Required when HAP is enabled.
+    #[arg(long, env = "HOMECORE_HAP_DEVICE_ID")]
+    hap_device_id: Option<String>,
+
+    /// LAN address published in the HAP mDNS record. Required when HAP is enabled.
+    #[arg(long, env = "HOMECORE_HAP_ADVERTISE_ADDR")]
+    hap_advertise_addr: Option<std::net::IpAddr>,
+
+    /// DNS hostname published by mDNS for the HAP bridge.
+    #[arg(long, env = "HOMECORE_HAP_HOSTNAME", default_value = "homecore")]
+    hap_hostname: String,
+
+    /// HAP discovery instance shown to controller applications.
+    #[arg(
+        long,
+        env = "HOMECORE_HAP_INSTANCE_NAME",
+        default_value = "HOMECORE Bridge"
+    )]
+    hap_instance_name: String,
+
+    /// Durable controller pairing database.
+    #[arg(
+        long,
+        env = "HOMECORE_HAP_PAIRING_STORE",
+        default_value = ".homecore/hap/pairings.json"
+    )]
+    hap_pairing_store: std::path::PathBuf,
 }
 
 #[tokio::main]
@@ -284,6 +319,18 @@ async fn main() -> Result<()> {
         "Assist intent endpoint ready with {} handlers",
         assist.handler_count()
     );
+    let hap_runtime = hap::start(
+        &hc,
+        hap::HapRuntimeConfig {
+            bind_addr: cli.hap_bind,
+            device_id: cli.hap_device_id.clone(),
+            advertise_addr: cli.hap_advertise_addr,
+            hostname: cli.hap_hostname.clone(),
+            instance_name: cli.hap_instance_name.clone(),
+            pairing_store: cli.hap_pairing_store.clone(),
+        },
+    )
+    .await?;
     let gw = GatewayState::with_assist(
         api_state.clone(),
         GatewayConfig {
@@ -334,6 +381,7 @@ async fn main() -> Result<()> {
             info!("Shutdown requested; draining active HTTP connections");
         })
         .await?;
+    hap_runtime.shutdown().await?;
     server_plugins.shutdown().await;
     Ok(())
 }
diff --git a/v2/docs/homecore-capabilities.md b/v2/docs/homecore-capabilities.md
index 14de8f0a..ae6daa4e 100644
--- a/v2/docs/homecore-capabilities.md
+++ b/v2/docs/homecore-capabilities.md
@@ -1,50 +1,73 @@
 # HOMECORE capability status
 
-This document describes the implemented runtime surface as of the current
-alpha. “Implemented” means wired into `homecore-server` and covered by tests;
-workspace libraries alone are not presented as server capabilities.
+This document describes the current alpha runtime. “Implemented” means the
+capability is wired into `homecore-server` or its public protocol crate and is
+covered by tests. It does not imply compatibility with every Home Assistant
+integration or every Apple Home controller.
 
-## Implemented
+## Runtime capabilities
 
-| Area | Runtime behavior |
+| Area | Current behavior |
 |---|---|
-| Core | Concurrent entity state machine, entity registry API, shared system/domain event bus, service registry, contexts |
-| Event flow | Committed state changes reach state subscribers and the shared event bus; service calls emit system events |
-| REST | API root, config, list/get/set/delete state, list/call service |
-| WebSocket | Auth handshake, ping, config/states/services queries, service calls, event subscribe/unsubscribe |
-| Backpressure | Per-connection WebSocket output is bounded to 256 messages; slow clients are disconnected from overflowing subscriptions |
-| Authentication | Token allowlist from `HOMECORE_TOKENS`; missing tokens fail startup unless insecure development mode is explicitly enabled |
-| Recorder | SQLite state history listener; broadcast lag is recovered by resynchronizing current state; optional ruvector semantic index |
+| Core | Concurrent entity state machine; entity and device registries; system/domain event buses; service registry; causal contexts |
+| Restore | Entity registry, device registry, and the most recent recorder state are restored in dependency order at startup; malformed rows are isolated and bounded |
+| Recorder | SQLite state history listener; deterministic latest-state queries; broadcast lag recovery; optional ruvector semantic index |
+| Migration | Entity/device registries and config entries are parsed with version checks, unknown forward-compatible fields are preserved, and output is written atomically without overwriting existing storage |
+| Plugins | Compiled-in native plugins use an explicit registry. Packaged Wasm plugins are discovered only in configured directories, bounded and path-checked, signature-verified against configured Ed25519 publishers, and run through Wasmtime when the `wasmtime` feature is enabled |
+| Plugin lifecycle | Plugin setup runs after restoration and built-in service registration; state changes are dispatched through a bounded queue; teardown runs during graceful shutdown |
 | Automation | State, numeric, event, and time triggers; optional YAML loading at server boot |
-| Assist | Authenticated `POST /api/intent/handle` with bounded regex recognition and five local handlers |
-| Built-in services | Real state mutation for `homeassistant`, `light`, and `switch` on/off/toggle; ping and state snapshot |
-| Migration | HA entity registry v1/minor 1–13 parsing and atomic, no-overwrite persistence into a HOMECORE storage directory |
+| Voice | Bounded PCM16 audio types, async STT/TTS provider contracts, an STT → intent → TTS pipeline, and an authenticated transport-independent satellite session protocol |
+| Assist | Authenticated local intent endpoint with bounded regex recognition and service-backed handlers |
+| HAP network | With `homecore-server --features hap-server`, an explicitly configured bounded TCP listener, persisted pairing records, live entity/accessory synchronization, and `_hap._tcp` mDNS lifecycle are wired into the server |
 | Dashboard/BFF | Static UI, calibration proxy, rooms, COG list, appliance metrics, and typed unavailable responses for absent upstreams |
 
-## Exact HA-style HTTP surface
+## Home Assistant-compatible REST surface
 
 - `GET /api/`
 - `GET /api/config`
+- `GET /api/components`
 - `GET /api/states`
 - `GET|POST|DELETE /api/states/:entity_id`
 - `GET /api/services`
 - `POST /api/services/:domain/:service`
+- `GET /api/events`
+- `POST /api/events/:event_type`
+- `POST /api/template`
+- `POST /api/config/core/check_config`
+- `GET /api/error_log`
 - `GET /api/websocket`
 - `POST /api/intent/handle`
+- `GET /api/homecore/compatibility`
 
-This is a compatible subset, not full Home Assistant parity.
+The WebSocket server implements authentication, feature negotiation, ping,
+configuration/state/service queries, service calls, event firing,
+subscribe/unsubscribe, template rendering, panels, and entity/device/area
+registry list commands. Per-connection output is bounded; lagging event
+subscribers resynchronize.
 
-## Explicitly deferred
+`GET /api/homecore/compatibility` is the machine-readable support matrix.
+HOMECORE implements the core contract above, not every endpoint contributed by
+Home Assistant integrations. History needs an attached recorder query surface;
+camera, calendar, media, and Lovelace behavior remain integration-dependent.
+Registry mutations require a persistent registry mutation backend. The area
+registry currently returns a valid empty list.
 
-- Loading native or Wasmtime plugins from `homecore-server`
-- A network HomeKit Accessory Protocol server, pairing, and mDNS advertisement
-- Device-registry persistence and full config-entry conversion
-- Full HA event/history/template/config/check endpoints
-- Restore-state on server startup
-- STT/TTS and satellite voice protocols
-- SEED/federation/witness/privacy upstream services when their daemons are absent
-- Claiming Home Assistant integration parity or production-scale performance
+## Security and deployment constraints
 
-Unavailable BFF upstreams return typed `503 upstream_unavailable`. Unsupported
-services are not registered. Synthetic biometric/demo entities are opt-in and
-must not be interpreted as live sensing data.
+- `HOMECORE_TOKENS` is required unless insecure development authentication is
+  explicitly enabled.
+- Unsigned Wasm packages are rejected unless the development-only override is
+  explicitly supplied. Arbitrary native dynamic libraries are never loaded;
+  native plugins must be linked into the binary and registered in code.
+- HAP is disabled by default. Enabling it requires an explicit bind address,
+  stable six-octet device identifier, advertised LAN address, hostname, and
+  durable pairing-store path.
+- The HAP listener fails closed for cryptographic phases that are unavailable
+  in the selected build. Do not claim Apple Home interoperability unless the
+  Pair-Setup, Pair-Verify, and encrypted transport conformance tests for that
+  build pass.
+- STT and TTS are provider contracts; a deployment must supply real providers.
+  The built-in disabled providers return typed errors rather than fabricated
+  speech results.
+- Synthetic biometric/demo entities are opt-in and must not be interpreted as
+  live sensing data.

From bc690ff309197dcc4bc6c086904cd15788c47595 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:43:48 -0400
Subject: [PATCH 10/16] feat(homecore-api): serve bounded recorder history

---
 v2/Cargo.lock                                 |   1 +
 v2/crates/homecore-api/Cargo.toml             |   1 +
 v2/crates/homecore-api/src/app.rs             |   5 +
 v2/crates/homecore-api/src/error.rs           |   7 +-
 v2/crates/homecore-api/src/rest.rs            | 139 +++++++++++++++++-
 v2/crates/homecore-api/src/state.rs           |  18 +++
 .../tests/compatibility_surface.rs            |  39 +++++
 v2/crates/homecore-server/src/main.rs         |   5 +-
 v2/docs/homecore-capabilities.md              |   6 +-
 9 files changed, 214 insertions(+), 7 deletions(-)

diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index cb875c09..5b44a110 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -3553,6 +3553,7 @@ dependencies = [
  "futures-util",
  "homecore",
  "homecore-automation",
+ "homecore-recorder",
  "http-body-util",
  "hyper 1.8.1",
  "serde",
diff --git a/v2/crates/homecore-api/Cargo.toml b/v2/crates/homecore-api/Cargo.toml
index 6e111c56..ccaafc11 100644
--- a/v2/crates/homecore-api/Cargo.toml
+++ b/v2/crates/homecore-api/Cargo.toml
@@ -18,6 +18,7 @@ path = "src/bin/server.rs"
 [dependencies]
 homecore = { path = "../homecore", version = "0.1.0-alpha.0" }
 homecore-automation = { path = "../homecore-automation", version = "0.1.0-alpha.0" }
+homecore-recorder = { path = "../homecore-recorder", version = "0.1.0-alpha.0" }
 
 axum = { version = "0.7", features = ["ws", "json", "macros"] }
 tokio = { version = "1", features = ["full"] }
diff --git a/v2/crates/homecore-api/src/app.rs b/v2/crates/homecore-api/src/app.rs
index e7d094e7..d090d50e 100644
--- a/v2/crates/homecore-api/src/app.rs
+++ b/v2/crates/homecore-api/src/app.rs
@@ -42,6 +42,11 @@ pub fn router(state: SharedState) -> Router {
         .route("/api/template", post(rest::render_template))
         .route("/api/config/core/check_config", post(rest::check_config))
         .route("/api/error_log", get(rest::error_log))
+        .route("/api/history/period", get(rest::get_history))
+        .route(
+            "/api/history/period/:start_time",
+            get(rest::get_history_period),
+        )
         .route("/api/homecore/compatibility", get(rest::compatibility))
         .route("/api/websocket", get(ws::websocket_handler))
         .layer(cors)
diff --git a/v2/crates/homecore-api/src/error.rs b/v2/crates/homecore-api/src/error.rs
index 9dfc027b..01a08950 100644
--- a/v2/crates/homecore-api/src/error.rs
+++ b/v2/crates/homecore-api/src/error.rs
@@ -14,6 +14,8 @@ pub enum ApiError {
     Unauthorized,
     #[error("service not registered: {domain}.{service}")]
     ServiceNotRegistered { domain: String, service: String },
+    #[error("service unavailable: {0}")]
+    Unavailable(String),
     #[error("internal error: {0}")]
     Internal(String),
 }
@@ -21,7 +23,9 @@ pub enum ApiError {
 pub type ApiResult<T> = Result<T, ApiError>;
 
 #[derive(Serialize)]
-struct ErrorPayload { message: String }
+struct ErrorPayload {
+    message: String,
+}
 
 impl IntoResponse for ApiError {
     fn into_response(self) -> Response {
@@ -30,6 +34,7 @@ impl IntoResponse for ApiError {
             Self::BadRequest(_) => (StatusCode::BAD_REQUEST, self.to_string()),
             Self::Unauthorized => (StatusCode::UNAUTHORIZED, self.to_string()),
             Self::ServiceNotRegistered { .. } => (StatusCode::BAD_REQUEST, self.to_string()),
+            Self::Unavailable(_) => (StatusCode::SERVICE_UNAVAILABLE, self.to_string()),
             Self::Internal(_) => (StatusCode::INTERNAL_SERVER_ERROR, self.to_string()),
         };
         (status, Json(ErrorPayload { message })).into_response()
diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index e576415e..3a3e5bd5 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -1,4 +1,4 @@
-use axum::extract::{Path, State};
+use axum::extract::{Path, Query, State};
 use axum::http::{HeaderMap, StatusCode};
 use axum::response::IntoResponse;
 use axum::Json;
@@ -92,6 +92,141 @@ pub struct StateView {
     pub context: ContextView,
 }
 
+#[derive(Debug, Deserialize)]
+pub struct HistoryQuery {
+    filter_entity_id: Option<String>,
+    end_time: Option<String>,
+    #[serde(default)]
+    minimal_response: bool,
+    #[serde(default)]
+    no_attributes: bool,
+    #[serde(default)]
+    significant_changes_only: bool,
+}
+
+const MAX_HISTORY_ENTITIES: usize = 32;
+
+pub async fn get_history(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Query(query): Query<HistoryQuery>,
+) -> ApiResult<Json<Vec<Vec<StateView>>>> {
+    history_response(headers, s, None, query).await
+}
+
+pub async fn get_history_period(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Path(start_time): Path<String>,
+    Query(query): Query<HistoryQuery>,
+) -> ApiResult<Json<Vec<Vec<StateView>>>> {
+    history_response(headers, s, Some(start_time), query).await
+}
+
+async fn history_response(
+    headers: HeaderMap,
+    state: SharedState,
+    start_time: Option<String>,
+    query: HistoryQuery,
+) -> ApiResult<Json<Vec<Vec<StateView>>>> {
+    let _ = BearerAuth::from_headers(&headers, state.tokens()).await?;
+    let recorder = state
+        .recorder()
+        .ok_or_else(|| ApiError::Unavailable("recorder is disabled".into()))?;
+    let now = chrono::Utc::now();
+    let start = match start_time {
+        Some(value) => parse_history_time(&value)?,
+        None => now - chrono::Duration::days(1),
+    };
+    let end = match query.end_time.as_deref() {
+        Some(value) => parse_history_time(value)?,
+        None => now,
+    };
+    if end < start {
+        return Err(ApiError::BadRequest(
+            "end_time must not precede start_time".into(),
+        ));
+    }
+
+    let entity_ids = match query.filter_entity_id.as_deref() {
+        Some(raw) => raw
+            .split(',')
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(|value| {
+                EntityId::parse(value)
+                    .map_err(|error| ApiError::BadRequest(format!("invalid entity_id: {error}")))
+            })
+            .collect::<ApiResult<Vec<_>>>()?,
+        None => state
+            .homecore()
+            .states()
+            .all()
+            .into_iter()
+            .map(|snapshot| snapshot.entity_id.clone())
+            .collect(),
+    };
+    if entity_ids.len() > MAX_HISTORY_ENTITIES {
+        return Err(ApiError::BadRequest(format!(
+            "history queries are limited to {MAX_HISTORY_ENTITIES} entities"
+        )));
+    }
+
+    let mut result = Vec::with_capacity(entity_ids.len());
+    for entity_id in entity_ids {
+        let rows = recorder
+            .get_state_history(&entity_id, start, end)
+            .await
+            .map_err(|error| ApiError::Internal(format!("history query failed: {error}")))?;
+        let mut previous_state: Option<String> = None;
+        let states = rows
+            .into_iter()
+            .filter_map(|row| {
+                if query.significant_changes_only
+                    && previous_state.as_deref() == Some(row.state.as_str())
+                {
+                    return None;
+                }
+                previous_state = Some(row.state.clone());
+                let changed = history_timestamp(row.last_changed_ts);
+                let updated = history_timestamp(row.last_updated_ts);
+                Some(StateView {
+                    entity_id: row.entity_id.as_str().to_owned(),
+                    state: row.state,
+                    attributes: if query.no_attributes || query.minimal_response {
+                        serde_json::json!({})
+                    } else {
+                        row.attributes
+                    },
+                    last_changed: changed,
+                    last_updated: updated,
+                    context: ContextView {
+                        id: row.context_id.unwrap_or_default(),
+                        user_id: None,
+                        parent_id: None,
+                    },
+                })
+            })
+            .collect();
+        result.push(states);
+    }
+    Ok(Json(result))
+}
+
+fn parse_history_time(value: &str) -> ApiResult<chrono::DateTime<chrono::Utc>> {
+    chrono::DateTime::parse_from_rfc3339(value)
+        .map(|value| value.with_timezone(&chrono::Utc))
+        .map_err(|_| ApiError::BadRequest("history timestamps must be RFC 3339".into()))
+}
+
+fn history_timestamp(seconds: f64) -> String {
+    let whole = seconds.floor() as i64;
+    let nanos = ((seconds - seconds.floor()) * 1_000_000_000.0).round() as u32;
+    chrono::DateTime::<chrono::Utc>::from_timestamp(whole, nanos.min(999_999_999))
+        .unwrap_or(chrono::DateTime::<chrono::Utc>::UNIX_EPOCH)
+        .to_rfc3339()
+}
+
 #[derive(Serialize)]
 pub struct ContextView {
     pub id: String,
@@ -373,7 +508,7 @@ pub async fn compatibility(
             "template": "implemented",
             "check_config": "implemented",
             "error_log": "implemented",
-            "history": "requires_recorder",
+            "history": "implemented_when_recorder_enabled",
             "camera_calendar_media": "integration_dependent"
         },
         "websocket": {
diff --git a/v2/crates/homecore-api/src/state.rs b/v2/crates/homecore-api/src/state.rs
index 0ec6b041..1a80d982 100644
--- a/v2/crates/homecore-api/src/state.rs
+++ b/v2/crates/homecore-api/src/state.rs
@@ -1,4 +1,5 @@
 use homecore::HomeCore;
+use homecore_recorder::Recorder;
 use std::sync::Arc;
 
 use crate::tokens::LongLivedTokenStore;
@@ -13,6 +14,7 @@ struct SharedStateInner {
     pub homecore_version: String,
     pub location_name: String,
     pub tokens: LongLivedTokenStore,
+    pub recorder: Option<Recorder>,
 }
 
 impl SharedState {
@@ -50,6 +52,19 @@ impl SharedState {
                 homecore_version: homecore_version.into(),
                 location_name: location_name.into(),
                 tokens,
+                recorder: None,
+            }),
+        }
+    }
+
+    pub fn with_recorder(self, recorder: Option<Recorder>) -> Self {
+        Self {
+            inner: Arc::new(SharedStateInner {
+                homecore: self.inner.homecore.clone(),
+                homecore_version: self.inner.homecore_version.clone(),
+                location_name: self.inner.location_name.clone(),
+                tokens: self.inner.tokens.clone(),
+                recorder,
             }),
         }
     }
@@ -66,4 +81,7 @@ impl SharedState {
     pub fn tokens(&self) -> &LongLivedTokenStore {
         &self.inner.tokens
     }
+    pub fn recorder(&self) -> Option<&Recorder> {
+        self.inner.recorder.as_ref()
+    }
 }
diff --git a/v2/crates/homecore-api/tests/compatibility_surface.rs b/v2/crates/homecore-api/tests/compatibility_surface.rs
index b4001b5d..66ec8df4 100644
--- a/v2/crates/homecore-api/tests/compatibility_surface.rs
+++ b/v2/crates/homecore-api/tests/compatibility_surface.rs
@@ -63,3 +63,42 @@ async fn compatibility_matrix_is_authenticated() {
         .unwrap();
     assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
 }
+
+#[tokio::test]
+async fn history_reads_real_recorder_rows() {
+    use homecore::{Context, EntityId};
+    use homecore_recorder::Recorder;
+
+    let homecore = HomeCore::new();
+    let recorder = Recorder::open("sqlite::memory:").await.unwrap();
+    let mut changes = homecore.states().subscribe();
+    homecore.states().set(
+        EntityId::parse("light.history_probe").unwrap(),
+        "on",
+        serde_json::json!({"brightness": 123}),
+        Context::new(),
+    );
+    let change = changes.recv().await.unwrap();
+    recorder.record_state(&change).await.unwrap();
+
+    let tokens = LongLivedTokenStore::empty();
+    tokens.register("test-token").await;
+    let state =
+        SharedState::with_tokens(homecore, "Test", "test", tokens).with_recorder(Some(recorder));
+    let response = router(state)
+        .oneshot(
+            Request::builder()
+                .uri("/api/history/period?filter_entity_id=light.history_probe")
+                .header("authorization", "Bearer test-token")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    let bytes = response.into_body().collect().await.unwrap().to_bytes();
+    let body: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
+    assert_eq!(body[0][0]["entity_id"], "light.history_probe");
+    assert_eq!(body[0][0]["state"], "on");
+    assert_eq!(body[0][0]["attributes"]["brightness"], 123);
+}
diff --git a/v2/crates/homecore-server/src/main.rs b/v2/crates/homecore-server/src/main.rs
index f5037fec..d6072aab 100644
--- a/v2/crates/homecore-server/src/main.rs
+++ b/v2/crates/homecore-server/src/main.rs
@@ -251,7 +251,7 @@ async fn main() -> Result<()> {
     }
 
     // ── 2. Recorder (optional) ──────────────────────────────────────
-    if let Some(recorder) = recorder {
+    if let Some(recorder) = recorder.clone() {
         let _recorder_task = RecorderListener::new(hc.states(), recorder).spawn();
         info!(
             "Recorder open at {} — state_changed events being persisted",
@@ -310,7 +310,8 @@ async fn main() -> Result<()> {
         cli.location_name,
         env!("CARGO_PKG_VERSION"),
         tokens,
-    );
+    )
+    .with_recorder(recorder);
     // BFF gateway (ADR-131 §11): single-origin aggregation of the
     // calibration API + SEED/appliance tiers. Shares the same token store
     // for auth; upstream credentials stay server-side.
diff --git a/v2/docs/homecore-capabilities.md b/v2/docs/homecore-capabilities.md
index ae6daa4e..b68f5b74 100644
--- a/v2/docs/homecore-capabilities.md
+++ b/v2/docs/homecore-capabilities.md
@@ -35,6 +35,7 @@ integration or every Apple Home controller.
 - `POST /api/template`
 - `POST /api/config/core/check_config`
 - `GET /api/error_log`
+- `GET /api/history/period[/<start_time>]`
 - `GET /api/websocket`
 - `POST /api/intent/handle`
 - `GET /api/homecore/compatibility`
@@ -47,8 +48,9 @@ subscribers resynchronize.
 
 `GET /api/homecore/compatibility` is the machine-readable support matrix.
 HOMECORE implements the core contract above, not every endpoint contributed by
-Home Assistant integrations. History needs an attached recorder query surface;
-camera, calendar, media, and Lovelace behavior remain integration-dependent.
+Home Assistant integrations. History is available when the recorder is
+enabled; camera, calendar, media, and Lovelace behavior remain
+integration-dependent.
 Registry mutations require a persistent registry mutation backend. The area
 registry currently returns a valid empty list.
 

From e47d40c5c4ed3310f3a8fddd4b10871bc71de17a Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:45:35 -0400
Subject: [PATCH 11/16] feat(homecore-api): add logbook and integration REST
 routes

---
 v2/crates/homecore-api/src/app.rs  |   5 +
 v2/crates/homecore-api/src/rest.rs | 175 ++++++++++++++++++++++++++++-
 v2/docs/homecore-capabilities.md   |   9 +-
 3 files changed, 186 insertions(+), 3 deletions(-)

diff --git a/v2/crates/homecore-api/src/app.rs b/v2/crates/homecore-api/src/app.rs
index d090d50e..fc895d31 100644
--- a/v2/crates/homecore-api/src/app.rs
+++ b/v2/crates/homecore-api/src/app.rs
@@ -47,6 +47,11 @@ pub fn router(state: SharedState) -> Router {
             "/api/history/period/:start_time",
             get(rest::get_history_period),
         )
+        .route("/api/logbook", get(rest::get_logbook))
+        .route("/api/logbook/:start_time", get(rest::get_logbook_period))
+        .route("/api/calendars", get(rest::get_calendars))
+        .route("/api/calendars/:entity_id", get(rest::get_calendar_events))
+        .route("/api/camera_proxy/:entity_id", get(rest::get_camera_proxy))
         .route("/api/homecore/compatibility", get(rest::compatibility))
         .route("/api/websocket", get(ws::websocket_handler))
         .layer(cors)
diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index 3a3e5bd5..87a791ef 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -227,6 +227,176 @@ fn history_timestamp(seconds: f64) -> String {
         .to_rfc3339()
 }
 
+#[derive(Debug, Deserialize)]
+pub struct LogbookQuery {
+    end_time: Option<String>,
+    entity: Option<String>,
+}
+
+pub async fn get_logbook(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Query(query): Query<LogbookQuery>,
+) -> ApiResult<Json<Vec<serde_json::Value>>> {
+    logbook_response(headers, s, None, query).await
+}
+
+pub async fn get_logbook_period(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Path(start_time): Path<String>,
+    Query(query): Query<LogbookQuery>,
+) -> ApiResult<Json<Vec<serde_json::Value>>> {
+    logbook_response(headers, s, Some(start_time), query).await
+}
+
+async fn logbook_response(
+    headers: HeaderMap,
+    state: SharedState,
+    start_time: Option<String>,
+    query: LogbookQuery,
+) -> ApiResult<Json<Vec<serde_json::Value>>> {
+    let _ = BearerAuth::from_headers(&headers, state.tokens()).await?;
+    let recorder = state
+        .recorder()
+        .ok_or_else(|| ApiError::Unavailable("recorder is disabled".into()))?;
+    let now = chrono::Utc::now();
+    let start = match start_time {
+        Some(value) => parse_history_time(&value)?,
+        None => now - chrono::Duration::days(1),
+    };
+    let end = match query.end_time.as_deref() {
+        Some(value) => parse_history_time(value)?,
+        None => now,
+    };
+    if end < start {
+        return Err(ApiError::BadRequest(
+            "end_time must not precede start_time".into(),
+        ));
+    }
+    let entity_ids = match query.entity.as_deref() {
+        Some(raw) => raw
+            .split(',')
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(|value| {
+                EntityId::parse(value)
+                    .map_err(|error| ApiError::BadRequest(format!("invalid entity_id: {error}")))
+            })
+            .collect::<ApiResult<Vec<_>>>()?,
+        None => state
+            .homecore()
+            .states()
+            .all()
+            .into_iter()
+            .map(|snapshot| snapshot.entity_id.clone())
+            .collect(),
+    };
+    if entity_ids.len() > MAX_HISTORY_ENTITIES {
+        return Err(ApiError::BadRequest(format!(
+            "logbook queries are limited to {MAX_HISTORY_ENTITIES} entities"
+        )));
+    }
+    let mut entries = Vec::new();
+    for entity_id in entity_ids {
+        let rows = recorder
+            .get_state_history(&entity_id, start, end)
+            .await
+            .map_err(|error| ApiError::Internal(format!("logbook query failed: {error}")))?;
+        for row in rows {
+            entries.push(serde_json::json!({
+                "when": history_timestamp(row.last_updated_ts),
+                "name": row.entity_id.as_str(),
+                "state": row.state,
+                "entity_id": row.entity_id.as_str(),
+                "context_id": row.context_id
+            }));
+        }
+    }
+    entries.sort_by(|left, right| {
+        left["when"]
+            .as_str()
+            .cmp(&right["when"].as_str())
+            .then_with(|| left["entity_id"].as_str().cmp(&right["entity_id"].as_str()))
+    });
+    Ok(Json(entries))
+}
+
+#[derive(Serialize)]
+pub struct CalendarView {
+    entity_id: String,
+    name: String,
+}
+
+pub async fn get_calendars(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+) -> ApiResult<Json<Vec<CalendarView>>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    let calendars = s
+        .homecore()
+        .states()
+        .all_by_domain("calendar")
+        .into_iter()
+        .map(|state| CalendarView {
+            entity_id: state.entity_id.as_str().to_owned(),
+            name: state
+                .attributes
+                .get("friendly_name")
+                .and_then(serde_json::Value::as_str)
+                .unwrap_or(state.entity_id.as_str())
+                .to_owned(),
+        })
+        .collect();
+    Ok(Json(calendars))
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CalendarQuery {
+    start: String,
+    end: String,
+}
+
+pub async fn get_calendar_events(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Path(entity_id): Path<String>,
+    Query(query): Query<CalendarQuery>,
+) -> ApiResult<Json<Vec<serde_json::Value>>> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    let id =
+        EntityId::parse(&entity_id).map_err(|error| ApiError::BadRequest(error.to_string()))?;
+    if id.domain() != "calendar" || s.homecore().states().get(&id).is_none() {
+        return Err(ApiError::NotFound(entity_id));
+    }
+    let start = parse_history_time(&query.start)?;
+    let end = parse_history_time(&query.end)?;
+    if end < start {
+        return Err(ApiError::BadRequest(
+            "end must not precede start".to_owned(),
+        ));
+    }
+    // Calendar integrations may expose their current entity without an event
+    // provider. An empty list is the valid response for that interval.
+    Ok(Json(Vec::new()))
+}
+
+pub async fn get_camera_proxy(
+    headers: HeaderMap,
+    State(s): State<SharedState>,
+    Path(entity_id): Path<String>,
+) -> ApiResult<StatusCode> {
+    let _ = BearerAuth::from_headers(&headers, s.tokens()).await?;
+    let id =
+        EntityId::parse(&entity_id).map_err(|error| ApiError::BadRequest(error.to_string()))?;
+    if id.domain() != "camera" || s.homecore().states().get(&id).is_none() {
+        return Err(ApiError::NotFound(entity_id));
+    }
+    Err(ApiError::Unavailable(
+        "camera integration has no image provider".into(),
+    ))
+}
+
 #[derive(Serialize)]
 pub struct ContextView {
     pub id: String,
@@ -509,7 +679,10 @@ pub async fn compatibility(
             "check_config": "implemented",
             "error_log": "implemented",
             "history": "implemented_when_recorder_enabled",
-            "camera_calendar_media": "integration_dependent"
+            "logbook": "implemented_when_recorder_enabled",
+            "calendar": "implemented_with_integration_supplied_events",
+            "camera": "implemented_with_integration_supplied_images",
+            "media": "integration_dependent"
         },
         "websocket": {
             "auth": "implemented",
diff --git a/v2/docs/homecore-capabilities.md b/v2/docs/homecore-capabilities.md
index b68f5b74..84abde27 100644
--- a/v2/docs/homecore-capabilities.md
+++ b/v2/docs/homecore-capabilities.md
@@ -36,6 +36,9 @@ integration or every Apple Home controller.
 - `POST /api/config/core/check_config`
 - `GET /api/error_log`
 - `GET /api/history/period[/<start_time>]`
+- `GET /api/logbook[/<start_time>]`
+- `GET /api/calendars[/:entity_id]`
+- `GET /api/camera_proxy/:entity_id`
 - `GET /api/websocket`
 - `POST /api/intent/handle`
 - `GET /api/homecore/compatibility`
@@ -49,8 +52,10 @@ subscribers resynchronize.
 `GET /api/homecore/compatibility` is the machine-readable support matrix.
 HOMECORE implements the core contract above, not every endpoint contributed by
 Home Assistant integrations. History is available when the recorder is
-enabled; camera, calendar, media, and Lovelace behavior remain
-integration-dependent.
+enabled. Calendar discovery and interval queries are implemented, with events
+supplied only by calendar integrations. Camera routing is implemented and
+returns a typed unavailable response when the entity has no image provider.
+Media and Lovelace behavior remain integration-dependent.
 Registry mutations require a persistent registry mutation backend. The area
 registry currently returns a valid empty list.
 

From b41b8c8a821181187c65bdb92c95c8abb73d36fa Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 14:47:04 -0400
Subject: [PATCH 12/16] fix(homecore-api): bound multi-entity history responses

---
 v2/crates/homecore-api/src/rest.rs    |  9 +++--
 v2/crates/homecore-recorder/src/db.rs | 50 ++++++++++++++++++++++++++-
 2 files changed, 56 insertions(+), 3 deletions(-)

diff --git a/v2/crates/homecore-api/src/rest.rs b/v2/crates/homecore-api/src/rest.rs
index 87a791ef..42f1bf48 100644
--- a/v2/crates/homecore-api/src/rest.rs
+++ b/v2/crates/homecore-api/src/rest.rs
@@ -105,6 +105,7 @@ pub struct HistoryQuery {
 }
 
 const MAX_HISTORY_ENTITIES: usize = 32;
+const MAX_API_HISTORY_ROWS: usize = 100_000;
 
 pub async fn get_history(
     headers: HeaderMap,
@@ -173,11 +174,13 @@ async fn history_response(
     }
 
     let mut result = Vec::with_capacity(entity_ids.len());
+    let mut remaining = MAX_API_HISTORY_ROWS;
     for entity_id in entity_ids {
         let rows = recorder
-            .get_state_history(&entity_id, start, end)
+            .get_state_history_limited(&entity_id, start, end, remaining)
             .await
             .map_err(|error| ApiError::Internal(format!("history query failed: {error}")))?;
+        remaining = remaining.saturating_sub(rows.len());
         let mut previous_state: Option<String> = None;
         let states = rows
             .into_iter()
@@ -298,11 +301,13 @@ async fn logbook_response(
         )));
     }
     let mut entries = Vec::new();
+    let mut remaining = MAX_API_HISTORY_ROWS;
     for entity_id in entity_ids {
         let rows = recorder
-            .get_state_history(&entity_id, start, end)
+            .get_state_history_limited(&entity_id, start, end, remaining)
             .await
             .map_err(|error| ApiError::Internal(format!("logbook query failed: {error}")))?;
+        remaining = remaining.saturating_sub(rows.len());
         for row in rows {
             entries.push(serde_json::json!({
                 "when": history_timestamp(row.last_updated_ts),
diff --git a/v2/crates/homecore-recorder/src/db.rs b/v2/crates/homecore-recorder/src/db.rs
index 741b33e5..3ca686fc 100644
--- a/v2/crates/homecore-recorder/src/db.rs
+++ b/v2/crates/homecore-recorder/src/db.rs
@@ -429,6 +429,24 @@ impl Recorder {
         since: DateTime<Utc>,
         until: DateTime<Utc>,
     ) -> Result<Vec<StateRow>, RecorderError> {
+        self.get_state_history_limited(entity_id, since, until, MAX_HISTORY_ROWS as usize)
+            .await
+    }
+
+    /// Query state history with a caller-selected limit capped by
+    /// [`MAX_HISTORY_ROWS`]. The bound is applied in SQL, before rows are
+    /// materialized.
+    pub async fn get_state_history_limited(
+        &self,
+        entity_id: &EntityId,
+        since: DateTime<Utc>,
+        until: DateTime<Utc>,
+        requested_limit: usize,
+    ) -> Result<Vec<StateRow>, RecorderError> {
+        let limit = requested_limit.min(MAX_HISTORY_ROWS as usize);
+        if limit == 0 {
+            return Ok(Vec::new());
+        }
         let since_ts = since.timestamp_micros() as f64 / 1_000_000.0;
         let until_ts = until.timestamp_micros() as f64 / 1_000_000.0;
 
@@ -446,7 +464,7 @@ impl Recorder {
         .bind(entity_id.as_str())
         .bind(since_ts)
         .bind(until_ts)
-        .bind(MAX_HISTORY_ROWS)
+        .bind(limit as i64)
         .fetch_all(&self.pool)
         .await?;
 
@@ -957,6 +975,36 @@ mod tests {
         assert_eq!(rows[2].state, "22.0");
     }
 
+    #[tokio::test]
+    async fn history_caller_limit_is_applied_before_materialization() {
+        let recorder = open_memory().await;
+        let eid = entity("sensor.bounded");
+        for value in ["1", "2", "3"] {
+            recorder
+                .record_state(&make_state_event(
+                    "sensor.bounded",
+                    value,
+                    serde_json::json!({}),
+                ))
+                .await
+                .unwrap();
+        }
+        let since = Utc::now() - chrono::Duration::seconds(10);
+        let until = Utc::now() + chrono::Duration::seconds(10);
+        let rows = recorder
+            .get_state_history_limited(&eid, since, until, 2)
+            .await
+            .unwrap();
+        assert_eq!(rows.len(), 2);
+        assert_eq!(rows[0].state, "1");
+        assert_eq!(rows[1].state, "2");
+        assert!(recorder
+            .get_state_history_limited(&eid, since, until, 0)
+            .await
+            .unwrap()
+            .is_empty());
+    }
+
     // ── record_event ──────────────────────────────────────────────────────────
 
     #[tokio::test]

From 42684a7a1e7402f0230bc669de85a0d41e93dce8 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 15:05:45 -0400
Subject: [PATCH 13/16] feat(hap): implement authenticated pairing and
 transport

---
 .../ADR-161-homecore-server-layer-security.md |  37 +-
 v2/Cargo.lock                                 | 322 +++++--
 v2/crates/homecore-hap/Cargo.toml             |  10 +-
 v2/crates/homecore-hap/README.md              | 132 +--
 v2/crates/homecore-hap/src/crypto.rs          | 253 ++++++
 v2/crates/homecore-hap/src/error.rs           |   3 +
 v2/crates/homecore-hap/src/lib.rs             |  16 +-
 v2/crates/homecore-hap/src/pair_setup.rs      | 478 ++++++++++
 v2/crates/homecore-hap/src/pair_verify.rs     | 332 +++++++
 v2/crates/homecore-hap/src/pairing.rs         | 620 ++++++++++---
 v2/crates/homecore-hap/src/protocol.rs        |  68 +-
 v2/crates/homecore-hap/src/server.rs          | 818 +++++++++++++++---
 v2/crates/homecore-hap/src/session.rs         | 119 +--
 13 files changed, 2734 insertions(+), 474 deletions(-)
 create mode 100644 v2/crates/homecore-hap/src/crypto.rs
 create mode 100644 v2/crates/homecore-hap/src/pair_setup.rs
 create mode 100644 v2/crates/homecore-hap/src/pair_verify.rs

diff --git a/docs/adr/ADR-161-homecore-server-layer-security.md b/docs/adr/ADR-161-homecore-server-layer-security.md
index 6fea0862..5787e073 100644
--- a/docs/adr/ADR-161-homecore-server-layer-security.md
+++ b/docs/adr/ADR-161-homecore-server-layer-security.md
@@ -224,8 +224,9 @@ touched:
   SHA-256-checks the module, Ed25519-verifies the signature against
   `publisher_key`, and enforces a `PluginPolicy` trust allowlist
   (secure-default rejects unsigned/untrusted/tampered modules).
-- **HAP real pairing (P2)** — SRP/HKDF pairing + encrypted sessions; current
-  bridge is an accessory-mapping surface. **ACCEPTED-FUTURE (honestly stubbed).**
+- **HAP real pairing (P2)** — **DONE (2026-07-27 addendum below).** SRP/HKDF
+  Pair-Setup, transcript-authenticated Pair-Verify, encrypted sessions, and
+  administrator-only pairing management now land as one fail-closed boundary.
 - **`RunMode::Queued`/`Restart`/`max` ordering** — ~~`Single`/`Parallel` are
   honored; bounded queueing, restart-kill, and `max` concurrency are not yet
   wired (every non-Single mode is parallel).~~ **DONE — ADR-162 §A5.** Restart
@@ -336,3 +337,35 @@ is still delivered (old code: 5s-timeout panic).
 +1 api-root accept-guard, +1 WS lag-survival), 0 failed. Workspace green.
 Python deterministic proof unchanged (homecore-api is off the signal proof
 path).
+
+## Addendum — HAP cryptographic boundary completed (2026-07-27)
+
+The P2 HAP deferral recorded above is closed as a single security boundary in
+`homecore-hap`; it was not replaced with a success-shaped partial protocol.
+
+- Pair-Setup M1-M6 uses RustCrypto SRP-6a with the RFC 5054 3072-bit group,
+  SHA-512 and HAP proof compatibility, followed by the specified
+  HKDF-SHA512, ChaCha20-Poly1305, and Ed25519 transcript construction.
+- Pair-Verify M1-M4 uses ephemeral X25519, strict Ed25519 transcript
+  verification, and separately derived directional control keys.
+- The TCP server changes to authenticated HAP record framing only after the
+  plaintext M4 response is written. Record lengths are authenticated, plaintext
+  is capped at 1024 bytes, counters are independent and monotonic, and any
+  authentication/replay/framing failure closes without an oracle response.
+- Accessory identity, signing seed, SRP verifier, and controller pairings share
+  one versioned, bounded, permission-checked, atomically replaced store. The raw
+  setup code is disclosed only on first provisioning and is not persisted.
+- Protected endpoints require an encrypted Pair-Verify session. Pairing
+  management rechecks current persisted administrator authority, handles the
+  last-admin invariant, updates mDNS paired state, and revokes live sessions.
+
+Evidence includes a deterministic HAP SRP vector, complete in-process
+Pair-Setup and Pair-Verify ceremonies, malformed/proof/transcript tests, record
+tamper/replay/oversize tests, persistence lifecycle tests, and a real TCP test
+that verifies Pair-Verify, accesses `/accessories` over encrypted records, then
+proves replay closes the connection.
+
+This closes the cryptographic implementation item, not the entire Apple Home
+product surface. Current-Apple/MFi interoperability has not been certified;
+transient/split Pair-Setup, writable/timed characteristics, resource endpoints,
+and persisted AID/IID allocation remain explicitly unsupported.
diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index 5b44a110..9ff7bed5 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -17,6 +17,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common 0.1.7",
+ "generic-array 0.14.7",
+]
+
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -398,6 +408,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.21.7"
@@ -518,6 +534,15 @@ dependencies = [
  "generic-array 0.14.7",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -894,6 +919,30 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -941,8 +990,9 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "inout",
+ "zeroize",
 ]
 
 [[package]]
@@ -985,6 +1035,12 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "cobs"
 version = "0.3.0"
@@ -1003,7 +1059,7 @@ dependencies = [
  "mdns-sd",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "tempfile",
  "thiserror 1.0.69",
  "tokio",
@@ -1025,7 +1081,7 @@ dependencies = [
  "safetensors 0.4.5",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "tempfile",
  "thiserror 1.0.69",
  "tokio",
@@ -1046,7 +1102,7 @@ dependencies = [
  "safetensors 0.4.5",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "tempfile",
  "thiserror 1.0.69",
  "tokio",
@@ -1149,6 +1205,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.1.5"
@@ -1246,6 +1308,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -1548,6 +1616,20 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "crypto-bigint"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.1",
+ "num-traits",
+ "rand_core 0.10.1",
+ "serdect",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -1555,9 +1637,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array 0.14.7",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom 0.4.1",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.29.6"
@@ -1616,6 +1710,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "cty"
 version = "0.2.2"
@@ -1652,7 +1755,7 @@ dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
- "digest",
+ "digest 0.10.7",
  "fiat-crypto",
  "rustc_version",
  "subtle",
@@ -1740,7 +1843,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -1791,12 +1894,23 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+]
+
 [[package]]
 name = "directories-next"
 version = "2.0.0"
@@ -1991,7 +2105,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
  "der",
- "digest",
+ "digest 0.10.7",
  "elliptic-curve",
  "rfc6979",
  "signature",
@@ -2017,7 +2131,7 @@ dependencies = [
  "curve25519-dalek",
  "ed25519",
  "serde",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -2037,9 +2151,9 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
- "crypto-bigint",
- "digest",
+ "base16ct 0.2.0",
+ "crypto-bigint 0.5.5",
+ "digest 0.10.7",
  "ff",
  "generic-array 0.14.7",
  "group",
@@ -3099,6 +3213,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
+ "rand_core 0.10.1",
  "wasip2",
  "wasip3",
 ]
@@ -3483,7 +3598,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -3603,17 +3718,25 @@ name = "homecore-hap"
 version = "0.1.0-alpha.0"
 dependencies = [
  "async-trait",
+ "chacha20poly1305",
  "ed25519-dalek",
+ "getrandom 0.2.17",
+ "hkdf",
  "homecore",
  "httparse",
  "mdns-sd",
  "serde",
  "serde_json",
+ "sha2 0.10.9",
+ "sha2 0.11.0",
+ "srp",
  "tempfile",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
  "uuid",
+ "x25519-dalek",
+ "zeroize",
 ]
 
 [[package]]
@@ -3644,7 +3767,7 @@ dependencies = [
  "homecore",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 1.0.69",
  "tokio",
  "uuid",
@@ -3663,7 +3786,7 @@ dependencies = [
  "ruvector-core",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "sqlx",
  "thiserror 1.0.69",
  "tokio",
@@ -3784,6 +3907,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "0.14.32"
@@ -4727,7 +4859,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
  "cfg-if",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -5380,7 +5512,7 @@ dependencies = [
  "serde",
  "serde-wasm-bindgen",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 2.0.18",
  "tracing",
  "wasm-bindgen",
@@ -5558,6 +5690,12 @@ version = "11.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "open"
 version = "5.3.3"
@@ -5703,7 +5841,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -5802,10 +5940,10 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
 dependencies = [
- "digest",
+ "digest 0.10.7",
  "hmac",
  "password-hash",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -5879,7 +6017,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
 dependencies = [
  "pest",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -6161,6 +6299,17 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "portable-atomic"
 version = "1.13.1"
@@ -6686,6 +6835,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_distr"
 version = "0.4.3"
@@ -7152,8 +7307,8 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
- "digest",
+ "const-oid 0.9.6",
+ "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
  "num-traits",
@@ -7260,7 +7415,7 @@ dependencies = [
  "rufield-core",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -7532,7 +7687,7 @@ checksum = "6c8ec5e03cc7a435945c81f1b151a2bc5f64f2206bf50150cab0f89981ce8c94"
 dependencies = [
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -7654,7 +7809,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -7678,7 +7833,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 2.0.18",
  "tokio",
  "tokio-test",
@@ -7839,7 +7994,7 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "der",
  "generic-array 0.14.7",
  "pkcs8",
@@ -8099,6 +8254,16 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct 1.0.0",
+ "serde",
+]
+
 [[package]]
 name = "serial"
 version = "0.4.0"
@@ -8200,7 +8365,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -8211,7 +8376,18 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -8283,7 +8459,7 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
- "digest",
+ "digest 0.10.7",
  "rand_core 0.6.4",
 ]
 
@@ -8520,7 +8696,7 @@ dependencies = [
  "percent-encoding",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "smallvec",
  "thiserror 2.0.18",
  "tokio",
@@ -8558,7 +8734,7 @@ dependencies = [
  "quote",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "sqlx-core",
  "sqlx-mysql",
  "sqlx-postgres",
@@ -8581,7 +8757,7 @@ dependencies = [
  "bytes",
  "chrono",
  "crc",
- "digest",
+ "digest 0.10.7",
  "dotenvy",
  "either",
  "futures-channel",
@@ -8602,7 +8778,7 @@ dependencies = [
  "rsa",
  "serde",
  "sha1",
- "sha2",
+ "sha2 0.10.9",
  "smallvec",
  "sqlx-core",
  "stringprep",
@@ -8641,7 +8817,7 @@ dependencies = [
  "rand 0.8.5",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "smallvec",
  "sqlx-core",
  "stringprep",
@@ -8677,6 +8853,18 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "srp"
+version = "0.7.0-rc.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b5f622c2d21b826b3501f4c620ccc4696e4a09a6b51727fcb21036dec87c101"
+dependencies = [
+ "crypto-bigint 0.7.5",
+ "crypto-common 0.2.2",
+ "digest 0.11.3",
+ "subtle",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -9087,7 +9275,7 @@ dependencies = [
  "semver",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "syn 2.0.117",
  "tauri-utils",
  "thiserror 2.0.18",
@@ -9984,9 +10172,9 @@ checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
 
 [[package]]
 name = "typenum"
-version = "1.19.0"
+version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
 [[package]]
 name = "ucd-trie"
@@ -10135,6 +10323,16 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
@@ -10730,7 +10928,7 @@ dependencies = [
  "rustix",
  "serde",
  "serde_derive",
- "sha2",
+ "sha2 0.10.9",
  "toml 0.9.12+spec-1.1.0",
  "windows-sys 0.61.2",
  "zstd 0.13.3",
@@ -11178,7 +11376,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serialport",
- "sha2",
+ "sha2 0.10.9",
  "sysinfo",
  "tauri",
  "tauri-build",
@@ -11232,7 +11430,7 @@ dependencies = [
  "midstreamer-scheduler",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -11352,7 +11550,7 @@ dependencies = [
  "ruvector-temporal-tensor",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 2.0.18",
 ]
 
@@ -11378,7 +11576,7 @@ dependencies = [
  "ruview-auth",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "tempfile",
  "thiserror 1.0.69",
@@ -11420,7 +11618,7 @@ dependencies = [
  "ruvector-solver",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "thiserror 2.0.18",
  "uuid",
  "wifi-densepose-core",
@@ -11452,7 +11650,7 @@ dependencies = [
  "ruvector-temporal-tensor",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "tch",
  "tempfile",
  "thiserror 2.0.18",
@@ -12297,7 +12495,7 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "raw-window-handle",
- "sha2",
+ "sha2 0.10.9",
  "soup3",
  "tao-macros",
  "thiserror 2.0.18",
@@ -12332,6 +12530,18 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "xattr"
 version = "1.6.1"
@@ -12444,6 +12654,20 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "zerotrie"
diff --git a/v2/crates/homecore-hap/Cargo.toml b/v2/crates/homecore-hap/Cargo.toml
index 537d196d..84388037 100644
--- a/v2/crates/homecore-hap/Cargo.toml
+++ b/v2/crates/homecore-hap/Cargo.toml
@@ -20,8 +20,6 @@ path = "src/lib.rs"
 [features]
 default = []
 # Enables the bounded TCP/HTTP listener and real `_hap._tcp` mDNS advertiser.
-# Pair-Setup, Pair-Verify, and encrypted HAP transport remain deliberately
-# unavailable until their complete cryptographic phases are implemented.
 hap-server = ["dep:httparse", "dep:mdns-sd"]
 
 [dependencies]
@@ -35,6 +33,14 @@ async-trait = "0.1"
 uuid = { version = "1", features = ["v4", "serde"] }
 ed25519-dalek = "2.1"
 tempfile = "3"
+chacha20poly1305 = "0.10"
+getrandom = "0.2"
+hkdf = "0.12"
+sha2 = "0.10"
+sha2_11 = { package = "sha2", version = "0.11" }
+srp = "=0.7.0-rc.3"
+x25519-dalek = { version = "2", features = ["static_secrets"] }
+zeroize = { version = "1", features = ["derive"] }
 httparse = { version = "1", optional = true }
 mdns-sd = { version = "0.11", optional = true }
 
diff --git a/v2/crates/homecore-hap/README.md b/v2/crates/homecore-hap/README.md
index 5eb54c8d..031ac6a5 100644
--- a/v2/crates/homecore-hap/README.md
+++ b/v2/crates/homecore-hap/README.md
@@ -1,63 +1,41 @@
 # homecore-hap
 
-`homecore-hap` is the fail-closed network foundation for HOMECORE's Apple
-HomeKit Accessory Protocol bridge (ADR-125). It maps HOMECORE entities to HAP
-services and provides the bounded server, persistence, discovery, and request
-gating needed by a complete HAP implementation.
+`homecore-hap` is HOMECORE's bounded, fail-closed HAP IP accessory server
+(ADR-125). It implements the HAP R2 cryptographic pairing and transport
+boundary without relying on the broken `hap` 0.1 pre-release crate.
 
-It does **not currently complete Apple Home pairing**. Pairing requests receive
-a valid TLV8 `Unavailable` error, and accessory/characteristic endpoints return
-HTTP 470 until an authenticated Pair-Verify session exists. There is no
-plaintext header, bearer-token, or test credential bypass.
+## Security and protocol coverage
 
-## Implemented
+- Pair-Setup M1-M6 uses the RFC 5054 3072-bit group with SHA-512, the HAP
+  compatibility proof construction, HKDF-SHA512, ChaCha20-Poly1305, and
+  Ed25519 long-term keys.
+- Pair-Verify M1-M4 uses ephemeral X25519, strict Ed25519 transcript
+  verification, HKDF-SHA512, and authenticated encrypted sub-TLVs.
+- After successful M4, all HTTP and `EVENT/1.0` traffic uses HAP records:
+  two-byte little-endian authenticated lengths, at most 1024 plaintext bytes,
+  independent directional keys, and monotonic 64-bit nonces. Authentication,
+  replay, truncation, and oversize failures close the connection without an
+  oracle response.
+- `/accessories`, `/characteristics`, and `/pairings` are inaccessible until
+  Pair-Verify succeeds on that TCP connection. Pairings add/remove/list is
+  restricted to a currently persisted administrator.
+- Accessory identity, Ed25519 seed, SRP salt/verifier, and controller records
+  are stored in a versioned file using same-directory atomic replacement.
+  Created Unix directories use mode `0700`, files use `0600`, and permissive,
+  oversized, symlinked, legacy, or malformed stores fail closed.
+- The raw setup code is returned only during first provisioning. Only its SRP
+  verifier is persisted; `SetupCode` redacts `Debug` output and zeroizes on
+  drop.
+- Removing the last administrator atomically clears every pairing. Live
+  sessions observe pairing revisions and are revoked, while the removal
+  response is delivered before the requesting session closes.
 
-- Bounded Tokio TCP lifecycle with connection, header, body, request-time, and
-  shutdown limits.
-- Incremental HTTP/1.1 parsing through `httparse`; duplicate
-  `Content-Length`, transfer encoding, truncated input, and oversized input
-  fail closed.
-- Versioned controller pairing records with bounded parsing, atomic same-
-  directory replacement, Unix `0600` files/`0700` created directories, and
-  refusal to load permissive or symlinked files.
-- Controller identifiers, administrator invariants, and Ed25519 public keys
-  validated through `ed25519-dalek`.
-- Session state machine for Connected, Pair-Setup, Pair-Verify, Authenticated,
-  and Closing. Authentication requires a valid signature from a persisted
-  controller over the Pair-Verify transcript supplied by the future protocol
-  phase.
-- Real `_hap._tcp.local.` advertisement through `mdns-sd` when
-  `hap-server` is enabled. `NullAdvertiser` provides deterministic,
-  network-free tests and deployments.
-- HAP-shaped `/accessories`, `/characteristics`, event subscription, and
-  `EVENT/1.0` flow backed by `HapBridge` snapshots and bounded broadcasts.
-  These handlers are structurally present but network-inaccessible until
-  encrypted Pair-Verify is complete.
+The server also bounds connections, headers, bodies, request time, shutdown,
+TLV sizes, controller counts, setup attempts, and concurrent Pair-Setup.
+mDNS advertises the persisted accessory identifier and updates `sf` after
+pairing or unpairing.
 
-## Deliberately incomplete protocol phases
-
-The following must land together before this crate may claim Apple Home
-interoperability:
-
-1. Pair-Setup M1-M6: SRP-6a proof exchange, setup-code policy, accessory
-   Ed25519 identity persistence, HKDF derivation, and ChaCha20-Poly1305
-   encrypted sub-TLVs.
-2. Pair-Verify M1-M4: ephemeral X25519 exchange, accessory/controller Ed25519
-   transcript signatures, HKDF session derivation, and encrypted sub-TLVs.
-3. Encrypted HAP transport: length-prefixed frames, independent read/write
-   ChaCha20-Poly1305 keys and monotonically increasing nonces, with strict
-   frame limits and connection teardown on authentication failure.
-4. Authenticated `/pairings` add/remove/list semantics and live mDNS `sf`
-   updates.
-5. Stable persisted AID/IID allocation and a HOMECORE service-call adapter for
-   writable characteristics. The present endpoint is read/event-only.
-6. Validation against Apple Home or a known-conformant HAP controller,
-   including pair, restart, event delivery, write, unpair, and re-pair.
-
-No cryptographic primitive should be implemented locally. The remaining work
-must use reviewed RustCrypto/PAKE crates and protocol test vectors.
-
-## Server integration
+## Provisioning and server integration
 
 ```rust,no_run
 use std::{net::IpAddr, sync::Arc};
@@ -67,15 +45,20 @@ use homecore_hap::{
 };
 
 # async fn run() -> Result<(), Box<dyn std::error::Error>> {
+let provisioned = PairingStore::load_or_create(
+    "/var/lib/homecore-hap/security.json",
+)?;
+if let Some(setup_code) = provisioned.setup_code.as_ref() {
+    // Send this once to a trusted local display or provisioning boundary.
+    println!("HAP setup code: {}", setup_code.expose());
+}
+let pairings = Arc::new(provisioned.store);
 let record = HapServiceRecord::bridge(
     "HOMECORE Bridge",
     51826,
-    "AA:BB:CC:DD:EE:FF",
+    pairings.accessory_id()?,
 );
 let bridge = HapBridge::new(record);
-let pairings = Arc::new(PairingStore::open(
-    "/var/lib/homecore-hap/pairings.json",
-)?);
 let advertiser = Arc::new(MdnsSdAdvertiser::new(
     "homecore",
     "192.168.1.50".parse::<IpAddr>()?,
@@ -89,24 +72,43 @@ let server = start_server(
 ).await?;
 
 // Feed HOMECORE StateChanged events through bridge.update_accessory(...).
-// On process shutdown:
 server.shutdown().await?;
 # Ok(())
 # }
 ```
 
+The mDNS device ID must equal the persisted accessory ID; startup rejects a
+mismatch. Real mDNS also requires a LAN-routable advertised address and
+multicast access.
+
+## Validation and remaining interoperability limits
+
+The deterministic suite covers the HAP SRP session-key vector, complete
+Pair-Setup and Pair-Verify ceremonies, transcript tampering, wrong proofs,
+malformed/replayed/oversized records, atomic restart, last-admin removal, and
+a real TCP lifecycle from Pair-Verify through encrypted `/accessories`.
+
+This is protocol-level HAP R2 coverage, not a claim of Apple certification:
+
+- It has not yet been exercised against a current Apple Home controller or
+  the current commercial MFi specification.
+- Transient and split Pair-Setup flags are rejected as `Unavailable`.
+- Writable characteristic service calls, timed writes, resource endpoints,
+  and stable persisted AID/IID allocation are not implemented. The present
+  characteristic surface is read and event subscription only.
+- Operational hardening still depends on protecting the host and the
+  `0600` security file; no hardware-backed key store is integrated.
+
 Build and test:
 
 ```bash
 cargo test -p homecore-hap --no-default-features
 cargo test -p homecore-hap --features hap-server
+cargo clippy -p homecore-hap --all-targets --features hap-server -- -D warnings
 ```
 
-Real mDNS requires the advertised address to be LAN-routable and the runtime to
-have multicast access. Containers normally need host networking or macvlan.
-
 ## Decisions
 
-- [ADR-125 — native Apple Home HAP bridge](../../docs/adr/ADR-125-ruview-apple-home-native-hap-bridge.md)
-- [ADR-130 — bounded async REST/WebSocket server patterns](../../docs/adr/ADR-130-homecore-rest-websocket-api.md)
-- [ADR-161 — server-layer security and explicit HAP deferral](../../docs/adr/ADR-161-homecore-server-layer-security.md)
+- [ADR-125 — native Apple Home HAP bridge](../../../docs/adr/ADR-125-ruview-apple-home-native-hap-bridge.md)
+- [ADR-130 — bounded async REST/WebSocket server patterns](../../../docs/adr/ADR-130-homecore-rest-websocket-api.md)
+- [ADR-161 — server-layer security and honest labeling](../../../docs/adr/ADR-161-homecore-server-layer-security.md)
diff --git a/v2/crates/homecore-hap/src/crypto.rs b/v2/crates/homecore-hap/src/crypto.rs
new file mode 100644
index 00000000..666ccba6
--- /dev/null
+++ b/v2/crates/homecore-hap/src/crypto.rs
@@ -0,0 +1,253 @@
+//! HAP cryptographic composition over RustCrypto primitives.
+#![cfg_attr(not(feature = "hap-server"), allow(dead_code))]
+
+use chacha20poly1305::aead::{Aead, Payload};
+use chacha20poly1305::{ChaCha20Poly1305, KeyInit, Nonce};
+use hkdf::Hkdf;
+use sha2::Sha512;
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use crate::error::HapError;
+
+pub(crate) const MAX_RECORD_PLAINTEXT: usize = 1024;
+pub(crate) const RECORD_TAG_BYTES: usize = 16;
+
+pub(crate) fn hkdf_sha512(
+    salt: &[u8],
+    input_key: &[u8],
+    info: &[u8],
+) -> Result<[u8; 32], HapError> {
+    let mut output = [0u8; 32];
+    Hkdf::<Sha512>::new(Some(salt), input_key)
+        .expand(info, &mut output)
+        .map_err(|_| HapError::Protocol("HKDF output length is invalid".into()))?;
+    Ok(output)
+}
+
+fn label_nonce(label: &[u8; 8]) -> [u8; 12] {
+    let mut nonce = [0u8; 12];
+    nonce[4..].copy_from_slice(label);
+    nonce
+}
+
+pub(crate) fn seal_labeled(
+    key: &[u8; 32],
+    label: &[u8; 8],
+    plaintext: &[u8],
+) -> Result<Vec<u8>, HapError> {
+    seal(key, &label_nonce(label), plaintext, &[])
+}
+
+pub(crate) fn open_labeled(
+    key: &[u8; 32],
+    label: &[u8; 8],
+    ciphertext_and_tag: &[u8],
+) -> Result<Vec<u8>, HapError> {
+    open(key, &label_nonce(label), ciphertext_and_tag, &[])
+}
+
+fn seal(
+    key: &[u8; 32],
+    nonce: &[u8; 12],
+    plaintext: &[u8],
+    aad: &[u8],
+) -> Result<Vec<u8>, HapError> {
+    ChaCha20Poly1305::new(key.into())
+        .encrypt(
+            Nonce::from_slice(nonce),
+            Payload {
+                msg: plaintext,
+                aad,
+            },
+        )
+        .map_err(|_| HapError::Protocol("ChaCha20-Poly1305 encryption failed".into()))
+}
+
+fn open(
+    key: &[u8; 32],
+    nonce: &[u8; 12],
+    ciphertext_and_tag: &[u8],
+    aad: &[u8],
+) -> Result<Vec<u8>, HapError> {
+    ChaCha20Poly1305::new(key.into())
+        .decrypt(
+            Nonce::from_slice(nonce),
+            Payload {
+                msg: ciphertext_and_tag,
+                aad,
+            },
+        )
+        .map_err(|_| HapError::Protocol("ChaCha20-Poly1305 authentication failed".into()))
+}
+
+#[derive(Zeroize, ZeroizeOnDrop)]
+pub(crate) struct SessionKeys {
+    accessory_to_controller: [u8; 32],
+    controller_to_accessory: [u8; 32],
+}
+
+impl SessionKeys {
+    pub(crate) fn derive(shared_secret: &[u8; 32]) -> Result<Self, HapError> {
+        Ok(Self {
+            accessory_to_controller: hkdf_sha512(
+                b"Control-Salt",
+                shared_secret,
+                b"Control-Read-Encryption-Key",
+            )?,
+            controller_to_accessory: hkdf_sha512(
+                b"Control-Salt",
+                shared_secret,
+                b"Control-Write-Encryption-Key",
+            )?,
+        })
+    }
+
+    #[cfg(test)]
+    pub(crate) fn controller_view(&self) -> Self {
+        Self {
+            accessory_to_controller: self.controller_to_accessory,
+            controller_to_accessory: self.accessory_to_controller,
+        }
+    }
+}
+
+/// Stateful HAP IP record protection. A failed decryption is terminal: callers
+/// must close the connection and must never retry with the same counter.
+#[derive(Zeroize, ZeroizeOnDrop)]
+pub(crate) struct RecordLayer {
+    read_key: [u8; 32],
+    write_key: [u8; 32],
+    read_counter: u64,
+    write_counter: u64,
+}
+
+impl RecordLayer {
+    pub(crate) fn accessory(keys: SessionKeys) -> Self {
+        Self {
+            read_key: keys.controller_to_accessory,
+            write_key: keys.accessory_to_controller,
+            read_counter: 0,
+            write_counter: 0,
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn controller(keys: SessionKeys) -> Self {
+        Self {
+            read_key: keys.controller_to_accessory,
+            write_key: keys.accessory_to_controller,
+            read_counter: 0,
+            write_counter: 0,
+        }
+    }
+
+    pub(crate) fn encrypt(&mut self, plaintext: &[u8]) -> Result<Vec<u8>, HapError> {
+        let mut output = Vec::with_capacity(
+            plaintext.len() + plaintext.len().div_ceil(MAX_RECORD_PLAINTEXT) * 18,
+        );
+        for chunk in plaintext.chunks(MAX_RECORD_PLAINTEXT) {
+            let length = u16::try_from(chunk.len())
+                .expect("HAP record chunks never exceed the u16 range")
+                .to_le_bytes();
+            let nonce = record_nonce(self.write_counter);
+            let encrypted = seal(&self.write_key, &nonce, chunk, &length)?;
+            self.write_counter = self
+                .write_counter
+                .checked_add(1)
+                .ok_or_else(|| HapError::Protocol("HAP write nonce exhausted".into()))?;
+            output.extend_from_slice(&length);
+            output.extend_from_slice(&encrypted);
+        }
+        Ok(output)
+    }
+
+    pub(crate) fn decrypt(
+        &mut self,
+        length_bytes: [u8; 2],
+        ciphertext_and_tag: &[u8],
+    ) -> Result<Vec<u8>, HapError> {
+        let length = u16::from_le_bytes(length_bytes) as usize;
+        if length > MAX_RECORD_PLAINTEXT {
+            return Err(HapError::Protocol(
+                "encrypted HAP record exceeds 1024 bytes".into(),
+            ));
+        }
+        if ciphertext_and_tag.len() != length + RECORD_TAG_BYTES {
+            return Err(HapError::Protocol(
+                "encrypted HAP record length does not match framing".into(),
+            ));
+        }
+        let nonce = record_nonce(self.read_counter);
+        let plaintext = open(&self.read_key, &nonce, ciphertext_and_tag, &length_bytes)?;
+        self.read_counter = self
+            .read_counter
+            .checked_add(1)
+            .ok_or_else(|| HapError::Protocol("HAP read nonce exhausted".into()))?;
+        Ok(plaintext)
+    }
+}
+
+fn record_nonce(counter: u64) -> [u8; 12] {
+    let mut nonce = [0u8; 12];
+    nonce[4..].copy_from_slice(&counter.to_le_bytes());
+    nonce
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn deterministic_record_vector_and_multiframe_roundtrip() {
+        let shared = [0x42; 32];
+        let keys = SessionKeys::derive(&shared).unwrap();
+        let mut vector_accessory = RecordLayer::accessory(keys);
+        let vector = vector_accessory.encrypt(b"HAP").unwrap();
+        assert_eq!(
+            vector,
+            [
+                0x03, 0x00, 0xa2, 0x37, 0x30, 0x29, 0xba, 0xe2, 0xa9, 0xa6, 0xbb, 0x5b, 0xff, 0xed,
+                0x6a, 0x29, 0x74, 0x12, 0xd1, 0x6d, 0x7a,
+            ]
+        );
+        let mut accessory = RecordLayer::accessory(SessionKeys::derive(&shared).unwrap());
+        let controller_keys = SessionKeys::derive(&shared).unwrap().controller_view();
+        let mut controller = RecordLayer::controller(controller_keys);
+        let plaintext = vec![0x5a; 2050];
+        let encrypted = accessory.encrypt(&plaintext).unwrap();
+        assert_eq!(&encrypted[..2], &[0, 4]);
+
+        let mut offset = 0;
+        let mut decrypted = Vec::new();
+        while offset < encrypted.len() {
+            let length_bytes: [u8; 2] = encrypted[offset..offset + 2].try_into().unwrap();
+            let length = u16::from_le_bytes(length_bytes) as usize;
+            let end = offset + 2 + length + RECORD_TAG_BYTES;
+            decrypted.extend(
+                controller
+                    .decrypt(length_bytes, &encrypted[offset + 2..end])
+                    .unwrap(),
+            );
+            offset = end;
+        }
+        assert_eq!(decrypted, plaintext);
+    }
+
+    #[test]
+    fn replay_tamper_and_oversize_fail_closed() {
+        let shared = [7; 32];
+        let mut sender = RecordLayer::accessory(SessionKeys::derive(&shared).unwrap());
+        let frame = sender.encrypt(b"authenticated").unwrap();
+        let length: [u8; 2] = frame[..2].try_into().unwrap();
+        let mut receiver =
+            RecordLayer::controller(SessionKeys::derive(&shared).unwrap().controller_view());
+        assert_eq!(
+            receiver.decrypt(length, &frame[2..]).unwrap(),
+            b"authenticated"
+        );
+        assert!(receiver.decrypt(length, &frame[2..]).is_err());
+        assert!(receiver
+            .decrypt(1025u16.to_le_bytes(), &vec![0; 1025 + RECORD_TAG_BYTES])
+            .is_err());
+    }
+}
diff --git a/v2/crates/homecore-hap/src/error.rs b/v2/crates/homecore-hap/src/error.rs
index 223cd737..b67563c2 100644
--- a/v2/crates/homecore-hap/src/error.rs
+++ b/v2/crates/homecore-hap/src/error.rs
@@ -33,6 +33,9 @@ pub enum HapError {
     #[error("controller pairing not found: {0}")]
     PairingNotFound(String),
 
+    #[error("maximum controller pairings reached")]
+    PairingCapacity,
+
     #[error("insecure permissions on {path}: mode {mode:o}; expected no group/other access")]
     InsecurePermissions { path: PathBuf, mode: u32 },
 
diff --git a/v2/crates/homecore-hap/src/lib.rs b/v2/crates/homecore-hap/src/lib.rs
index 7b1f8359..f02058bf 100644
--- a/v2/crates/homecore-hap/src/lib.rs
+++ b/v2/crates/homecore-hap/src/lib.rs
@@ -2,11 +2,10 @@
 //!
 //! # Network foundation scope
 //!
-//! The crate provides persisted controller records, a fail-closed session
-//! state machine, bounded TLV8 parsing, characteristic event flow, and (with
-//! `hap-server`) a bounded TCP/HTTP listener plus real mDNS. It does **not**
-//! yet implement SRP Pair-Setup, X25519/HKDF/ChaCha20-Poly1305 Pair-Verify, or
-//! encrypted HAP framing, so Apple Home pairing is deliberately unavailable.
+//! The crate provides persisted accessory/controller identity, SRP-6a
+//! Pair-Setup, X25519/Ed25519 Pair-Verify, encrypted HAP IP framing, bounded
+//! TLV8/HTTP parsing, characteristic event flow, and (with `hap-server`) a
+//! bounded TCP listener plus real mDNS.
 //!
 //! # Module layout
 //!
@@ -16,7 +15,7 @@
 //! | [`mapping`] | `EntityToAccessoryMapper` — HOMECORE entity → HAP |
 //! | [`bridge`] | `HapBridge` — owns exposed accessories |
 //! | [`mdns`] | `MdnsAdvertiser` trait + `NullAdvertiser` stub |
-//! | [`pairing`] | Atomic controller pairing persistence |
+//! | [`pairing`] | Atomic accessory identity, setup, and pairing persistence |
 //! | [`protocol`] | Bounded TLV8 protocol primitives |
 //! | [`ruview`] | `RuViewToHapMapper` — sensing primitives → HAP |
 //! | [`session`] | Authenticated request-gating state machine |
@@ -25,9 +24,12 @@
 
 pub mod accessory;
 pub mod bridge;
+mod crypto;
 pub mod error;
 pub mod mapping;
 pub mod mdns;
+mod pair_setup;
+mod pair_verify;
 pub mod pairing;
 pub mod protocol;
 pub mod ruview;
@@ -42,7 +44,7 @@ pub use mapping::EntityToAccessoryMapper;
 #[cfg(feature = "hap-server")]
 pub use mdns::MdnsSdAdvertiser;
 pub use mdns::{HapServiceRecord, MdnsAdvertiser, NullAdvertiser};
-pub use pairing::{ControllerPairing, PairingStore};
+pub use pairing::{ControllerPairing, PairingStore, PairingStoreProvisioning, SetupCode};
 pub use ruview::RuViewToHapMapper;
 #[cfg(feature = "hap-server")]
 pub use server::{start_server, HapServerConfig, HapServerHandle};
diff --git a/v2/crates/homecore-hap/src/pair_setup.rs b/v2/crates/homecore-hap/src/pair_setup.rs
new file mode 100644
index 00000000..9be92593
--- /dev/null
+++ b/v2/crates/homecore-hap/src/pair_setup.rs
@@ -0,0 +1,478 @@
+//! Server-side HAP Pair-Setup M1-M6.
+#![cfg_attr(not(feature = "hap-server"), allow(dead_code))]
+
+use std::sync::Arc;
+
+use ed25519_dalek::{Signature, Signer, VerifyingKey};
+use sha2_11::Sha512;
+use srp::ServerG3072;
+use zeroize::{Zeroize, Zeroizing};
+
+use crate::crypto::{hkdf_sha512, open_labeled, seal_labeled};
+use crate::error::HapError;
+use crate::pairing::{ControllerPairing, PairingStore};
+use crate::protocol::{
+    encode_items, error_response, Tlv8, TLV_ENCRYPTED_DATA, TLV_ERROR_AUTHENTICATION,
+    TLV_ERROR_BUSY, TLV_ERROR_MAX_TRIES, TLV_ERROR_UNAVAILABLE, TLV_FLAGS, TLV_IDENTIFIER,
+    TLV_METHOD, TLV_PROOF, TLV_PUBLIC_KEY, TLV_SALT, TLV_SIGNATURE, TLV_STATE,
+};
+
+const SRP_USERNAME: &[u8] = b"Pair-Setup";
+const PAIR_SETUP_METHOD: u8 = 0;
+
+enum Phase {
+    Idle,
+    AwaitM3 {
+        salt: [u8; 16],
+        verifier: Vec<u8>,
+        server_secret: Zeroizing<Vec<u8>>,
+    },
+    AwaitM5 {
+        session_key: Zeroizing<Vec<u8>>,
+    },
+}
+
+pub(crate) struct PairSetup {
+    store: Arc<PairingStore>,
+    phase: Phase,
+    owns_global_slot: bool,
+}
+
+pub(crate) struct PairSetupResponse {
+    pub(crate) body: Vec<u8>,
+    pub(crate) paired: bool,
+    pub(crate) terminal: bool,
+}
+
+impl PairSetup {
+    pub(crate) fn new(store: Arc<PairingStore>) -> Self {
+        Self {
+            store,
+            phase: Phase::Idle,
+            owns_global_slot: false,
+        }
+    }
+
+    pub(crate) fn handle(&mut self, request: &[u8]) -> Result<PairSetupResponse, HapError> {
+        let tlv = Tlv8::parse(request)?;
+        let state = tlv
+            .byte(TLV_STATE)
+            .ok_or_else(|| HapError::Protocol("Pair-Setup requires one-byte State".into()))?;
+        match state {
+            1 => self.m1(&tlv),
+            3 => self.m3(&tlv),
+            5 => self.m5(&tlv),
+            _ => Err(HapError::Protocol(
+                "Pair-Setup state is out of sequence".into(),
+            )),
+        }
+    }
+
+    fn m1(&mut self, tlv: &Tlv8) -> Result<PairSetupResponse, HapError> {
+        if !matches!(self.phase, Phase::Idle) {
+            return Err(HapError::Protocol("Pair-Setup M1 was replayed".into()));
+        }
+        if tlv.byte(TLV_METHOD) != Some(PAIR_SETUP_METHOD) {
+            return Ok(response(
+                error_response(2, TLV_ERROR_UNAVAILABLE),
+                false,
+                true,
+            ));
+        }
+        if tlv.get(TLV_FLAGS).is_some() {
+            // Transient/split setup changes the session-key lifecycle and is
+            // deliberately rejected instead of being partially implemented.
+            return Ok(response(
+                error_response(2, TLV_ERROR_UNAVAILABLE),
+                false,
+                true,
+            ));
+        }
+        if self.store.is_paired()? {
+            return Ok(response(
+                error_response(2, TLV_ERROR_UNAVAILABLE),
+                false,
+                true,
+            ));
+        }
+        if self.store.pair_setup_locked_out() {
+            return Ok(response(
+                error_response(2, TLV_ERROR_MAX_TRIES),
+                false,
+                true,
+            ));
+        }
+        if !self.store.try_begin_pair_setup() {
+            return Ok(response(error_response(2, TLV_ERROR_BUSY), false, true));
+        }
+        self.owns_global_slot = true;
+
+        let (salt, verifier) = self.store.setup_record()?;
+        let mut server_secret = Zeroizing::new(vec![0u8; 64]);
+        getrandom::getrandom(server_secret.as_mut_slice())
+            .map_err(|error| HapError::Protocol(format!("generate SRP secret: {error}")))?;
+        let server = ServerG3072::<Sha512>::new_with_options(false);
+        let public_key = server.compute_public_ephemeral(&server_secret, &verifier);
+        self.phase = Phase::AwaitM3 {
+            salt,
+            verifier,
+            server_secret,
+        };
+        Ok(response(
+            encode_items([
+                (TLV_STATE, [2].as_slice()),
+                (TLV_PUBLIC_KEY, public_key.as_slice()),
+                (TLV_SALT, salt.as_slice()),
+            ]),
+            false,
+            false,
+        ))
+    }
+
+    fn m3(&mut self, tlv: &Tlv8) -> Result<PairSetupResponse, HapError> {
+        let Phase::AwaitM3 {
+            salt,
+            verifier,
+            server_secret,
+        } = std::mem::replace(&mut self.phase, Phase::Idle)
+        else {
+            return Err(HapError::Protocol(
+                "Pair-Setup M3 arrived without M1".into(),
+            ));
+        };
+        let result = (|| {
+            let client_public = required_bounded(tlv, TLV_PUBLIC_KEY, 384, 384, "SRP public key")?;
+            let client_proof = required_bounded(tlv, TLV_PROOF, 64, 64, "SRP proof")?;
+            let server = ServerG3072::<Sha512>::new_with_options(false);
+            let verifier_state = server
+                .process_reply(
+                    SRP_USERNAME,
+                    &salt,
+                    &server_secret,
+                    &verifier,
+                    client_public,
+                )
+                .map_err(|_| HapError::Protocol("invalid SRP public key".into()))?;
+            let session_key = verifier_state
+                .verify_client(client_proof)
+                .map_err(|_| HapError::Protocol("SRP proof rejected".into()))?
+                .to_vec();
+            let proof = verifier_state.proof().to_vec();
+            Ok::<_, HapError>((session_key, proof))
+        })();
+        match result {
+            Ok((session_key, proof)) => {
+                self.phase = Phase::AwaitM5 {
+                    session_key: Zeroizing::new(session_key),
+                };
+                Ok(response(
+                    encode_items([(TLV_STATE, [4].as_slice()), (TLV_PROOF, proof.as_slice())]),
+                    false,
+                    false,
+                ))
+            }
+            Err(_) => {
+                self.store.record_pair_setup_failure();
+                self.release_slot();
+                Ok(response(
+                    error_response(4, TLV_ERROR_AUTHENTICATION),
+                    false,
+                    true,
+                ))
+            }
+        }
+    }
+
+    fn m5(&mut self, tlv: &Tlv8) -> Result<PairSetupResponse, HapError> {
+        let Phase::AwaitM5 { session_key } = std::mem::replace(&mut self.phase, Phase::Idle) else {
+            return Err(HapError::Protocol(
+                "Pair-Setup M5 arrived without authenticated M3".into(),
+            ));
+        };
+        let result = self.finish_m5(tlv, &session_key);
+        if result.is_err() {
+            self.store.record_pair_setup_failure();
+        }
+        self.release_slot();
+        match result {
+            Ok(body) => Ok(response(body, true, true)),
+            Err(_) => Ok(response(
+                error_response(6, TLV_ERROR_AUTHENTICATION),
+                false,
+                true,
+            )),
+        }
+    }
+
+    fn finish_m5(&self, tlv: &Tlv8, session_key: &[u8]) -> Result<Vec<u8>, HapError> {
+        let encrypted = required_bounded(
+            tlv,
+            TLV_ENCRYPTED_DATA,
+            17,
+            4096,
+            "Pair-Setup encrypted data",
+        )?;
+        let encryption_key = hkdf_sha512(
+            b"Pair-Setup-Encrypt-Salt",
+            session_key,
+            b"Pair-Setup-Encrypt-Info",
+        )?;
+        let mut plaintext = Zeroizing::new(open_labeled(&encryption_key, b"PS-Msg05", encrypted)?);
+        let sub_tlv = Tlv8::parse(&plaintext)?;
+        let controller_id_bytes =
+            required_bounded(&sub_tlv, TLV_IDENTIFIER, 1, 64, "controller identifier")?;
+        let controller_id = std::str::from_utf8(controller_id_bytes)
+            .map_err(|_| HapError::Protocol("controller identifier is not UTF-8".into()))?
+            .to_owned();
+        let controller_key: [u8; 32] =
+            required_bounded(&sub_tlv, TLV_PUBLIC_KEY, 32, 32, "controller LTPK")?
+                .try_into()
+                .expect("length checked");
+        let signature_bytes: [u8; 64] =
+            required_bounded(&sub_tlv, TLV_SIGNATURE, 64, 64, "controller signature")?
+                .try_into()
+                .expect("length checked");
+        let verifying_key = VerifyingKey::from_bytes(&controller_key)
+            .map_err(|_| HapError::Protocol("controller LTPK is invalid".into()))?;
+        let controller_x = hkdf_sha512(
+            b"Pair-Setup-Controller-Sign-Salt",
+            session_key,
+            b"Pair-Setup-Controller-Sign-Info",
+        )?;
+        let mut controller_info =
+            Zeroizing::new(Vec::with_capacity(32 + controller_id_bytes.len() + 32));
+        controller_info.extend_from_slice(&controller_x);
+        controller_info.extend_from_slice(controller_id_bytes);
+        controller_info.extend_from_slice(&controller_key);
+        verifying_key
+            .verify_strict(&controller_info, &Signature::from_bytes(&signature_bytes))
+            .map_err(|_| HapError::Protocol("controller signature rejected".into()))?;
+
+        let signing_key = self.store.signing_key()?;
+        let accessory_id = self.store.accessory_id()?;
+        let accessory_public = signing_key.verifying_key().to_bytes();
+        let accessory_x = hkdf_sha512(
+            b"Pair-Setup-Accessory-Sign-Salt",
+            session_key,
+            b"Pair-Setup-Accessory-Sign-Info",
+        )?;
+        let mut accessory_info = Zeroizing::new(Vec::with_capacity(32 + accessory_id.len() + 32));
+        accessory_info.extend_from_slice(&accessory_x);
+        accessory_info.extend_from_slice(accessory_id.as_bytes());
+        accessory_info.extend_from_slice(&accessory_public);
+        let accessory_signature = signing_key.sign(&accessory_info).to_bytes();
+        let mut response_plaintext = Zeroizing::new(encode_items([
+            (TLV_IDENTIFIER, accessory_id.as_bytes()),
+            (TLV_PUBLIC_KEY, accessory_public.as_slice()),
+            (TLV_SIGNATURE, accessory_signature.as_slice()),
+        ]));
+        let response_encrypted = seal_labeled(&encryption_key, b"PS-Msg06", &response_plaintext)?;
+
+        // Commit only after every authentication and response construction
+        // step has succeeded, and before emitting success-shaped M6.
+        self.store.add_initial(ControllerPairing {
+            controller_id,
+            public_key: controller_key,
+            admin: true,
+        })?;
+        plaintext.zeroize();
+        response_plaintext.zeroize();
+        Ok(encode_items([
+            (TLV_STATE, [6].as_slice()),
+            (TLV_ENCRYPTED_DATA, response_encrypted.as_slice()),
+        ]))
+    }
+
+    fn release_slot(&mut self) {
+        if self.owns_global_slot {
+            self.store.end_pair_setup();
+            self.owns_global_slot = false;
+        }
+    }
+}
+
+impl Drop for PairSetup {
+    fn drop(&mut self) {
+        self.release_slot();
+    }
+}
+
+fn response(body: Vec<u8>, paired: bool, terminal: bool) -> PairSetupResponse {
+    PairSetupResponse {
+        body,
+        paired,
+        terminal,
+    }
+}
+
+fn required_bounded<'a>(
+    tlv: &'a Tlv8,
+    kind: u8,
+    min: usize,
+    max: usize,
+    name: &str,
+) -> Result<&'a [u8], HapError> {
+    let value = tlv
+        .get(kind)
+        .ok_or_else(|| HapError::Protocol(format!("missing {name}")))?;
+    if !(min..=max).contains(&value.len()) {
+        return Err(HapError::Protocol(format!(
+            "{name} must contain {min}..={max} bytes"
+        )));
+    }
+    Ok(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ed25519_dalek::SigningKey;
+    use srp::ClientG3072;
+
+    fn setup() -> (tempfile::TempDir, Arc<PairingStore>) {
+        let directory = tempfile::tempdir().unwrap();
+        let store = PairingStore::create(
+            directory.path().join("pairings.json"),
+            crate::pairing::SetupCode::parse("518-26-003").unwrap(),
+            Some("AA:BB:CC:DD:EE:FF".into()),
+        )
+        .unwrap();
+        (directory, Arc::new(store))
+    }
+
+    #[test]
+    fn apple_hap_srp_3072_sha512_session_key_vector() {
+        let decode = |value: &str| {
+            value
+                .as_bytes()
+                .chunks_exact(2)
+                .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap())
+                .collect::<Vec<_>>()
+        };
+        let salt = decode("BEB25379D1A8581EB5A727673A2441EE");
+        let a = decode("60975527035CF2AD1989806F0407210BC81EDC04E2762A56AFD529DDDA2D4393");
+        let b = decode("E487CB59D31AC550471E81F00F6928E01DDA08E974A004F49E61F5D105284D20");
+        let expected_key = decode(
+            "5CBC219DB052138EE1148C71CD4498963D682549CE91CA24F098468F06015BEB\
+             6AF245C2093F98C3651BCA83AB8CAB2B580BBF02184FEFDF26142F73DF95AC50",
+        );
+        let client = ClientG3072::<Sha512>::new();
+        let server = ServerG3072::<Sha512>::new_with_options(false);
+        let verifier = client.compute_verifier(b"alice", b"password123", &salt);
+        let a_public = client.compute_public_ephemeral(&a);
+        let b_public = server.compute_public_ephemeral(&b, &verifier);
+        let client_state = client
+            .process_reply(&a, b"alice", b"password123", &salt, &b_public)
+            .unwrap();
+        let server_state = server
+            .process_reply(b"alice", &salt, &b, &verifier, &a_public)
+            .unwrap();
+        assert_eq!(
+            server_state.verify_client(client_state.proof()).unwrap(),
+            expected_key
+        );
+        assert_eq!(
+            client_state.verify_server(server_state.proof()).unwrap(),
+            expected_key
+        );
+    }
+
+    #[test]
+    fn full_m1_through_m6_persists_only_authenticated_controller() {
+        let (_directory, store) = setup();
+        let mut server = PairSetup::new(store.clone());
+        let m1 = encode_items([(TLV_STATE, [1].as_slice()), (TLV_METHOD, [0].as_slice())]);
+        let m2 = Tlv8::parse(&server.handle(&m1).unwrap().body).unwrap();
+        let salt = m2.get(TLV_SALT).unwrap();
+        let server_public = m2.get(TLV_PUBLIC_KEY).unwrap();
+        let client = ClientG3072::<Sha512>::new();
+        let client_secret = [0x31; 48];
+        let client_state = client
+            .process_reply(
+                &client_secret,
+                SRP_USERNAME,
+                b"518-26-003",
+                salt,
+                server_public,
+            )
+            .unwrap();
+        let client_public = client.compute_public_ephemeral(&client_secret);
+        let m3 = encode_items([
+            (TLV_STATE, [3].as_slice()),
+            (TLV_PUBLIC_KEY, client_public.as_slice()),
+            (TLV_PROOF, client_state.proof()),
+        ]);
+        let m4 = Tlv8::parse(&server.handle(&m3).unwrap().body).unwrap();
+        let session_key = client_state
+            .verify_server(m4.get(TLV_PROOF).unwrap())
+            .unwrap();
+
+        let controller_signing = SigningKey::from_bytes(&[0x22; 32]);
+        let controller_public = controller_signing.verifying_key().to_bytes();
+        let controller_id = b"deterministic-controller";
+        let controller_x = hkdf_sha512(
+            b"Pair-Setup-Controller-Sign-Salt",
+            session_key,
+            b"Pair-Setup-Controller-Sign-Info",
+        )
+        .unwrap();
+        let mut info = Vec::new();
+        info.extend_from_slice(&controller_x);
+        info.extend_from_slice(controller_id);
+        info.extend_from_slice(&controller_public);
+        let signature = controller_signing.sign(&info).to_bytes();
+        let sub_tlv = encode_items([
+            (TLV_IDENTIFIER, controller_id.as_slice()),
+            (TLV_PUBLIC_KEY, controller_public.as_slice()),
+            (TLV_SIGNATURE, signature.as_slice()),
+        ]);
+        let encryption_key = hkdf_sha512(
+            b"Pair-Setup-Encrypt-Salt",
+            session_key,
+            b"Pair-Setup-Encrypt-Info",
+        )
+        .unwrap();
+        let encrypted = seal_labeled(&encryption_key, b"PS-Msg05", &sub_tlv).unwrap();
+        let m5 = encode_items([
+            (TLV_STATE, [5].as_slice()),
+            (TLV_ENCRYPTED_DATA, encrypted.as_slice()),
+        ]);
+        let result = server.handle(&m5).unwrap();
+        assert!(result.paired);
+        let m6 = Tlv8::parse(&result.body).unwrap();
+        assert!(open_labeled(
+            &encryption_key,
+            b"PS-Msg06",
+            m6.get(TLV_ENCRYPTED_DATA).unwrap()
+        )
+        .is_ok());
+        assert_eq!(
+            store
+                .get("deterministic-controller")
+                .unwrap()
+                .unwrap()
+                .public_key,
+            controller_public
+        );
+    }
+
+    #[test]
+    fn malformed_replayed_and_wrong_proof_requests_fail_closed() {
+        let (_directory, store) = setup();
+        let mut server = PairSetup::new(store.clone());
+        let m1 = encode_items([(TLV_STATE, [1].as_slice()), (TLV_METHOD, [0].as_slice())]);
+        assert!(!server.handle(&m1).unwrap().paired);
+        assert!(server.handle(&m1).is_err());
+        let bad_m3 = encode_items([
+            (TLV_STATE, [3].as_slice()),
+            (TLV_PUBLIC_KEY, [1].as_slice()),
+            (TLV_PROOF, [0u8; 64].as_slice()),
+        ]);
+        let response = Tlv8::parse(&server.handle(&bad_m3).unwrap().body).unwrap();
+        assert_eq!(
+            response.byte(crate::protocol::TLV_ERROR),
+            Some(TLV_ERROR_AUTHENTICATION)
+        );
+        assert!(!store.is_paired().unwrap());
+    }
+}
diff --git a/v2/crates/homecore-hap/src/pair_verify.rs b/v2/crates/homecore-hap/src/pair_verify.rs
new file mode 100644
index 00000000..e705cef6
--- /dev/null
+++ b/v2/crates/homecore-hap/src/pair_verify.rs
@@ -0,0 +1,332 @@
+//! Server-side HAP Pair-Verify M1-M4.
+#![cfg_attr(not(feature = "hap-server"), allow(dead_code))]
+
+use std::sync::Arc;
+
+use ed25519_dalek::{Signature, Signer, VerifyingKey};
+use x25519_dalek::{PublicKey, StaticSecret};
+use zeroize::{Zeroize, Zeroizing};
+
+use crate::crypto::{hkdf_sha512, open_labeled, seal_labeled, SessionKeys};
+use crate::error::HapError;
+use crate::pairing::PairingStore;
+use crate::protocol::{
+    encode_items, error_response, Tlv8, TLV_ENCRYPTED_DATA, TLV_ERROR_AUTHENTICATION,
+    TLV_IDENTIFIER, TLV_PUBLIC_KEY, TLV_SIGNATURE, TLV_STATE,
+};
+
+struct AwaitM3 {
+    controller_public: [u8; 32],
+    accessory_public: [u8; 32],
+    shared_secret: Zeroizing<[u8; 32]>,
+    session_key: Zeroizing<[u8; 32]>,
+}
+
+enum Phase {
+    Idle,
+    AwaitM3(AwaitM3),
+}
+
+pub(crate) struct AuthenticatedSession {
+    pub(crate) controller_id: String,
+    pub(crate) admin: bool,
+    pub(crate) keys: SessionKeys,
+}
+
+pub(crate) struct PairVerifyResponse {
+    pub(crate) body: Vec<u8>,
+    pub(crate) authenticated: Option<AuthenticatedSession>,
+    pub(crate) terminal: bool,
+}
+
+pub(crate) struct PairVerify {
+    store: Arc<PairingStore>,
+    phase: Phase,
+}
+
+impl PairVerify {
+    pub(crate) fn new(store: Arc<PairingStore>) -> Self {
+        Self {
+            store,
+            phase: Phase::Idle,
+        }
+    }
+
+    pub(crate) fn handle(&mut self, request: &[u8]) -> Result<PairVerifyResponse, HapError> {
+        let tlv = Tlv8::parse(request)?;
+        let state = tlv
+            .byte(TLV_STATE)
+            .ok_or_else(|| HapError::Protocol("Pair-Verify requires one-byte State".into()))?;
+        match state {
+            1 => self.m1(&tlv),
+            3 => self.m3(&tlv),
+            _ => Err(HapError::Protocol(
+                "Pair-Verify state is out of sequence".into(),
+            )),
+        }
+    }
+
+    fn m1(&mut self, tlv: &Tlv8) -> Result<PairVerifyResponse, HapError> {
+        if !matches!(self.phase, Phase::Idle) {
+            return Err(HapError::Protocol("Pair-Verify M1 was replayed".into()));
+        }
+        if !self.store.is_paired()? {
+            return Ok(PairVerifyResponse {
+                body: error_response(2, TLV_ERROR_AUTHENTICATION),
+                authenticated: None,
+                terminal: true,
+            });
+        }
+        let controller_public: [u8; 32] =
+            required_exact(tlv, TLV_PUBLIC_KEY, 32, "controller Curve25519 public key")?
+                .try_into()
+                .expect("length checked");
+        let mut secret_bytes = Zeroizing::new([0u8; 32]);
+        getrandom::getrandom(secret_bytes.as_mut())
+            .map_err(|error| HapError::Protocol(format!("generate X25519 secret: {error}")))?;
+        let secret = StaticSecret::from(*secret_bytes);
+        let accessory_public = PublicKey::from(&secret).to_bytes();
+        let shared = secret.diffie_hellman(&PublicKey::from(controller_public));
+        if !shared.was_contributory() {
+            return Ok(PairVerifyResponse {
+                body: error_response(2, TLV_ERROR_AUTHENTICATION),
+                authenticated: None,
+                terminal: true,
+            });
+        }
+        let shared_secret = Zeroizing::new(shared.to_bytes());
+        let accessory_id = self.store.accessory_id()?;
+        let signing_key = self.store.signing_key()?;
+        let mut accessory_info = Zeroizing::new(Vec::with_capacity(32 + accessory_id.len() + 32));
+        accessory_info.extend_from_slice(&accessory_public);
+        accessory_info.extend_from_slice(accessory_id.as_bytes());
+        accessory_info.extend_from_slice(&controller_public);
+        let signature = signing_key.sign(&accessory_info).to_bytes();
+        let plaintext = Zeroizing::new(encode_items([
+            (TLV_IDENTIFIER, accessory_id.as_bytes()),
+            (TLV_SIGNATURE, signature.as_slice()),
+        ]));
+        let session_key = Zeroizing::new(hkdf_sha512(
+            b"Pair-Verify-Encrypt-Salt",
+            shared_secret.as_ref(),
+            b"Pair-Verify-Encrypt-Info",
+        )?);
+        let encrypted = seal_labeled(&session_key, b"PV-Msg02", &plaintext)?;
+        self.phase = Phase::AwaitM3(AwaitM3 {
+            controller_public,
+            accessory_public,
+            shared_secret,
+            session_key,
+        });
+        Ok(PairVerifyResponse {
+            body: encode_items([
+                (TLV_STATE, [2].as_slice()),
+                (TLV_PUBLIC_KEY, accessory_public.as_slice()),
+                (TLV_ENCRYPTED_DATA, encrypted.as_slice()),
+            ]),
+            authenticated: None,
+            terminal: false,
+        })
+    }
+
+    fn m3(&mut self, tlv: &Tlv8) -> Result<PairVerifyResponse, HapError> {
+        let Phase::AwaitM3(state) = std::mem::replace(&mut self.phase, Phase::Idle) else {
+            return Err(HapError::Protocol(
+                "Pair-Verify M3 arrived without M1".into(),
+            ));
+        };
+        match self.finish_m3(tlv, state) {
+            Ok(authenticated) => Ok(PairVerifyResponse {
+                body: encode_items([(TLV_STATE, [4].as_slice())]),
+                authenticated: Some(authenticated),
+                terminal: true,
+            }),
+            Err(_) => Ok(PairVerifyResponse {
+                body: error_response(4, TLV_ERROR_AUTHENTICATION),
+                authenticated: None,
+                terminal: true,
+            }),
+        }
+    }
+
+    fn finish_m3(&self, tlv: &Tlv8, state: AwaitM3) -> Result<AuthenticatedSession, HapError> {
+        let encrypted = tlv
+            .get(TLV_ENCRYPTED_DATA)
+            .filter(|value| (17..=4096).contains(&value.len()))
+            .ok_or_else(|| HapError::Protocol("invalid Pair-Verify encrypted data".into()))?;
+        let mut plaintext =
+            Zeroizing::new(open_labeled(&state.session_key, b"PV-Msg03", encrypted)?);
+        let sub_tlv = Tlv8::parse(&plaintext)?;
+        let controller_id_bytes = sub_tlv
+            .get(TLV_IDENTIFIER)
+            .filter(|value| !value.is_empty() && value.len() <= 64)
+            .ok_or_else(|| HapError::Protocol("invalid controller identifier".into()))?;
+        let controller_id = std::str::from_utf8(controller_id_bytes)
+            .map_err(|_| HapError::Protocol("controller identifier is not UTF-8".into()))?
+            .to_owned();
+        let signature_bytes: [u8; 64] =
+            required_exact(&sub_tlv, TLV_SIGNATURE, 64, "controller signature")?
+                .try_into()
+                .expect("length checked");
+        let pairing = self
+            .store
+            .get(&controller_id)?
+            .ok_or_else(|| HapError::Protocol("unknown controller pairing".into()))?;
+        let key = VerifyingKey::from_bytes(&pairing.public_key)
+            .map_err(|_| HapError::Protocol("persisted controller key is invalid".into()))?;
+        let mut controller_info =
+            Zeroizing::new(Vec::with_capacity(32 + controller_id_bytes.len() + 32));
+        controller_info.extend_from_slice(&state.controller_public);
+        controller_info.extend_from_slice(controller_id_bytes);
+        controller_info.extend_from_slice(&state.accessory_public);
+        key.verify_strict(&controller_info, &Signature::from_bytes(&signature_bytes))
+            .map_err(|_| HapError::Protocol("controller transcript signature rejected".into()))?;
+        let keys = SessionKeys::derive(&state.shared_secret)?;
+        plaintext.zeroize();
+        Ok(AuthenticatedSession {
+            controller_id,
+            admin: pairing.admin,
+            keys,
+        })
+    }
+}
+
+fn required_exact<'a>(
+    tlv: &'a Tlv8,
+    kind: u8,
+    length: usize,
+    name: &str,
+) -> Result<&'a [u8], HapError> {
+    tlv.get(kind)
+        .filter(|value| value.len() == length)
+        .ok_or_else(|| HapError::Protocol(format!("{name} must contain {length} bytes")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::crypto::RecordLayer;
+    use crate::pairing::{ControllerPairing, SetupCode};
+    use ed25519_dalek::SigningKey;
+
+    fn setup() -> (tempfile::TempDir, Arc<PairingStore>, SigningKey) {
+        let directory = tempfile::tempdir().unwrap();
+        let store = PairingStore::create(
+            directory.path().join("pairings.json"),
+            SetupCode::parse("518-26-003").unwrap(),
+            Some("AA:BB:CC:DD:EE:FF".into()),
+        )
+        .unwrap();
+        let controller = SigningKey::from_bytes(&[0x44; 32]);
+        store
+            .add_initial(ControllerPairing {
+                controller_id: "controller-1".into(),
+                public_key: controller.verifying_key().to_bytes(),
+                admin: true,
+            })
+            .unwrap();
+        (directory, Arc::new(store), controller)
+    }
+
+    #[test]
+    fn full_m1_through_m4_authenticates_transcript_and_derives_record_keys() {
+        let (_directory, store, controller_signing) = setup();
+        let mut server = PairVerify::new(store.clone());
+        let controller_secret = StaticSecret::from([0x33; 32]);
+        let controller_public = PublicKey::from(&controller_secret).to_bytes();
+        let m1 = encode_items([
+            (TLV_STATE, [1].as_slice()),
+            (TLV_PUBLIC_KEY, controller_public.as_slice()),
+        ]);
+        let m2 = Tlv8::parse(&server.handle(&m1).unwrap().body).unwrap();
+        let accessory_public: [u8; 32] = m2.get(TLV_PUBLIC_KEY).unwrap().try_into().unwrap();
+        let shared = controller_secret.diffie_hellman(&PublicKey::from(accessory_public));
+        let session_key = hkdf_sha512(
+            b"Pair-Verify-Encrypt-Salt",
+            shared.as_bytes(),
+            b"Pair-Verify-Encrypt-Info",
+        )
+        .unwrap();
+        let accessory_sub_tlv = Tlv8::parse(
+            &open_labeled(
+                &session_key,
+                b"PV-Msg02",
+                m2.get(TLV_ENCRYPTED_DATA).unwrap(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+        let accessory_id = accessory_sub_tlv.get(TLV_IDENTIFIER).unwrap();
+        let accessory_signature: [u8; 64] = accessory_sub_tlv
+            .get(TLV_SIGNATURE)
+            .unwrap()
+            .try_into()
+            .unwrap();
+        let mut accessory_info = Vec::new();
+        accessory_info.extend_from_slice(&accessory_public);
+        accessory_info.extend_from_slice(accessory_id);
+        accessory_info.extend_from_slice(&controller_public);
+        VerifyingKey::from_bytes(&store.accessory_public_key().unwrap())
+            .unwrap()
+            .verify_strict(
+                &accessory_info,
+                &Signature::from_bytes(&accessory_signature),
+            )
+            .unwrap();
+
+        let controller_id = b"controller-1";
+        let mut controller_info = Vec::new();
+        controller_info.extend_from_slice(&controller_public);
+        controller_info.extend_from_slice(controller_id);
+        controller_info.extend_from_slice(&accessory_public);
+        let signature = controller_signing.sign(&controller_info).to_bytes();
+        let sub_tlv = encode_items([
+            (TLV_IDENTIFIER, controller_id.as_slice()),
+            (TLV_SIGNATURE, signature.as_slice()),
+        ]);
+        let encrypted = seal_labeled(&session_key, b"PV-Msg03", &sub_tlv).unwrap();
+        let m3 = encode_items([
+            (TLV_STATE, [3].as_slice()),
+            (TLV_ENCRYPTED_DATA, encrypted.as_slice()),
+        ]);
+        let result = server.handle(&m3).unwrap();
+        assert_eq!(Tlv8::parse(&result.body).unwrap().byte(TLV_STATE), Some(4));
+        let authenticated = result.authenticated.unwrap();
+        assert_eq!(authenticated.controller_id, "controller-1");
+        let mut accessory_records = RecordLayer::accessory(authenticated.keys);
+        let encrypted_record = accessory_records.encrypt(b"response").unwrap();
+        assert!(!encrypted_record
+            .windows(8)
+            .any(|window| window == b"response"));
+    }
+
+    #[test]
+    fn all_zero_key_replay_and_tamper_fail_closed() {
+        let (_directory, store, _) = setup();
+        let mut server = PairVerify::new(store);
+        let zero_key = encode_items([
+            (TLV_STATE, [1].as_slice()),
+            (TLV_PUBLIC_KEY, [0u8; 32].as_slice()),
+        ]);
+        let response = Tlv8::parse(&server.handle(&zero_key).unwrap().body).unwrap();
+        assert_eq!(
+            response.byte(crate::protocol::TLV_ERROR),
+            Some(TLV_ERROR_AUTHENTICATION)
+        );
+
+        let controller_secret = StaticSecret::from([9; 32]);
+        let controller_public = PublicKey::from(&controller_secret).to_bytes();
+        let m1 = encode_items([
+            (TLV_STATE, [1].as_slice()),
+            (TLV_PUBLIC_KEY, controller_public.as_slice()),
+        ]);
+        let _ = server.handle(&m1).unwrap();
+        assert!(server.handle(&m1).is_err());
+        let tampered = encode_items([
+            (TLV_STATE, [3].as_slice()),
+            (TLV_ENCRYPTED_DATA, [0u8; 17].as_slice()),
+        ]);
+        let response = server.handle(&tampered).unwrap();
+        assert!(response.authenticated.is_none());
+    }
+}
diff --git a/v2/crates/homecore-hap/src/pairing.rs b/v2/crates/homecore-hap/src/pairing.rs
index b2d81478..73e6a221 100644
--- a/v2/crates/homecore-hap/src/pairing.rs
+++ b/v2/crates/homecore-hap/src/pairing.rs
@@ -1,31 +1,35 @@
-//! Durable controller pairing records.
-//!
-//! This module persists only long-term controller identities and Ed25519 public
-//! keys. It does not implement HAP Pair-Setup or Pair-Verify. Those protocol
-//! phases must populate this store only after their cryptographic transcript
-//! has been authenticated.
+//! Durable HAP accessory identity, setup verifier, and controller pairings.
+#![cfg_attr(not(feature = "hap-server"), allow(dead_code))]
 
 use std::collections::BTreeMap;
 use std::fs::{self, File};
 use std::io::{Read, Write};
 use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, AtomicU16, Ordering};
 use std::sync::RwLock;
 
-use ed25519_dalek::VerifyingKey;
+use ed25519_dalek::{SigningKey, VerifyingKey};
 use serde::{Deserialize, Serialize};
+use sha2_11::Sha512;
+use srp::ClientG3072;
 use tempfile::Builder;
+use tokio::sync::watch;
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
 
 use crate::error::HapError;
 
-const STORE_VERSION: u32 = 1;
+const STORE_VERSION: u32 = 2;
 const MAX_STORE_BYTES: u64 = 1024 * 1024;
 const MAX_CONTROLLER_ID_BYTES: usize = 64;
+const MAX_CONTROLLERS: usize = 16;
+const MAX_PAIR_SETUP_FAILURES: u16 = 100;
+const SRP_USERNAME: &[u8] = b"Pair-Setup";
 
 /// A controller authorized by a completed HAP pairing ceremony.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct ControllerPairing {
-    /// HAP controller pairing identifier.
+    /// Case-sensitive HAP controller pairing identifier.
     pub controller_id: String,
     /// Controller Ed25519 long-term public key.
     pub public_key: [u8; 32],
@@ -52,113 +56,434 @@ impl ControllerPairing {
     }
 }
 
+/// A newly provisioned HAP setup code.
+///
+/// The code is returned only when a store is created. The persisted file holds
+/// an SRP verifier instead of the raw code. Call [`SetupCode::expose`] only at
+/// the operator-facing provisioning boundary.
+#[derive(Zeroize, ZeroizeOnDrop)]
+pub struct SetupCode {
+    bytes: [u8; 10],
+}
+
+impl SetupCode {
+    pub fn parse(value: &str) -> Result<Self, HapError> {
+        let bytes: [u8; 10] = value.as_bytes().try_into().map_err(|_| {
+            HapError::InvalidPairingRecord("setup code must use the XXX-XX-XXX format".into())
+        })?;
+        if bytes[3] != b'-'
+            || bytes[6] != b'-'
+            || bytes
+                .iter()
+                .enumerate()
+                .any(|(index, byte)| index != 3 && index != 6 && !byte.is_ascii_digit())
+        {
+            return Err(HapError::InvalidPairingRecord(
+                "setup code must use the XXX-XX-XXX format".into(),
+            ));
+        }
+        let digits: Vec<u8> = bytes.iter().copied().filter(u8::is_ascii_digit).collect();
+        if is_trivial_setup_code(&digits) {
+            return Err(HapError::InvalidPairingRecord(
+                "setup code is prohibited because it is trivial".into(),
+            ));
+        }
+        Ok(Self { bytes })
+    }
+
+    /// Explicitly expose the code for a display, label, or provisioning UI.
+    pub fn expose(&self) -> &str {
+        std::str::from_utf8(&self.bytes).expect("validated setup code is ASCII")
+    }
+
+    pub(crate) fn as_bytes(&self) -> &[u8] {
+        &self.bytes
+    }
+
+    fn generate() -> Result<Self, HapError> {
+        const RANGE: u32 = 100_000_000;
+        const ACCEPT_BELOW: u32 = (u32::MAX / RANGE) * RANGE;
+        loop {
+            let mut random = [0u8; 4];
+            getrandom::getrandom(&mut random)
+                .map_err(|error| HapError::PairingStore(format!("generate setup code: {error}")))?;
+            let sample = u32::from_le_bytes(random);
+            if sample >= ACCEPT_BELOW {
+                continue;
+            }
+            let digits = format!("{:08}", sample % RANGE);
+            if is_trivial_setup_code(digits.as_bytes()) {
+                continue;
+            }
+            return Self::parse(&format!(
+                "{}-{}-{}",
+                &digits[..3],
+                &digits[3..5],
+                &digits[5..]
+            ));
+        }
+    }
+}
+
+impl std::fmt::Debug for SetupCode {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("SetupCode([REDACTED])")
+    }
+}
+
+fn is_trivial_setup_code(digits: &[u8]) -> bool {
+    digits == b"12345678"
+        || digits == b"87654321"
+        || (digits.len() == 8 && digits.iter().all(|digit| *digit == digits[0]))
+}
+
+/// Result of opening an existing store or provisioning a new one.
+pub struct PairingStoreProvisioning {
+    pub store: PairingStore,
+    /// Present only on first creation. It is never recoverable from the store.
+    pub setup_code: Option<SetupCode>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct StoredAccessory {
+    device_id: String,
+    signing_seed: [u8; 32],
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct StoredSetup {
+    salt: [u8; 16],
+    verifier: Vec<u8>,
+}
+
+impl Drop for StoredAccessory {
+    fn drop(&mut self) {
+        self.signing_seed.zeroize();
+    }
+}
+
+impl Drop for StoredSetup {
+    fn drop(&mut self) {
+        self.salt.zeroize();
+        self.verifier.zeroize();
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct PairingFile {
     version: u32,
+    accessory: StoredAccessory,
+    setup: StoredSetup,
     controllers: Vec<ControllerPairing>,
 }
 
-/// Thread-safe, atomically persisted controller pairing store.
+#[derive(Debug, Clone)]
+struct StoreState {
+    accessory: StoredAccessory,
+    setup: StoredSetup,
+    controllers: BTreeMap<String, ControllerPairing>,
+}
+
+/// Thread-safe, atomically persisted HAP security store.
 #[derive(Debug)]
 pub struct PairingStore {
     path: PathBuf,
-    controllers: RwLock<BTreeMap<String, ControllerPairing>>,
+    state: RwLock<StoreState>,
+    pair_setup_active: AtomicBool,
+    pair_setup_failures: AtomicU16,
+    changes: watch::Sender<u64>,
 }
 
 impl PairingStore {
-    /// Open an existing store or create an empty in-memory store.
-    ///
-    /// Existing files with group/other permission bits on Unix are rejected
-    /// instead of silently accepting exposed controller keys.
+    /// Open an existing v2 store.
     pub fn open(path: impl Into<PathBuf>) -> Result<Self, HapError> {
         let path = path.into();
-        let controllers = if path.exists() {
-            load_file(&path)?
-        } else {
-            BTreeMap::new()
-        };
-        Ok(Self {
-            path,
-            controllers: RwLock::new(controllers),
+        if !path.exists() {
+            return Err(HapError::PairingStore(format!(
+                "{} does not exist; use PairingStore::load_or_create for first provisioning",
+                path.display()
+            )));
+        }
+        Self::from_state(path.clone(), load_file(&path)?)
+    }
+
+    /// Open a store, or securely create identity/setup material and return the
+    /// one-time setup code.
+    pub fn load_or_create(path: impl Into<PathBuf>) -> Result<PairingStoreProvisioning, HapError> {
+        let path = path.into();
+        if path.exists() {
+            return Ok(PairingStoreProvisioning {
+                store: Self::open(path)?,
+                setup_code: None,
+            });
+        }
+        let setup_code = SetupCode::generate()?;
+        let state = new_state(&setup_code, None)?;
+        persist_file(&path, &state, false)?;
+        Ok(PairingStoreProvisioning {
+            store: Self::from_state(path, state)?,
+            setup_code: Some(setup_code),
+        })
+    }
+
+    /// Deterministic provisioning entry point for an externally generated
+    /// per-accessory setup code and optional device ID.
+    pub fn create(
+        path: impl Into<PathBuf>,
+        setup_code: SetupCode,
+        device_id: Option<String>,
+    ) -> Result<Self, HapError> {
+        let path = path.into();
+        if path.exists() {
+            return Err(HapError::PairingStore(format!(
+                "{} already exists",
+                path.display()
+            )));
+        }
+        let state = new_state(&setup_code, device_id)?;
+        persist_file(&path, &state, false)?;
+        Self::from_state(path, state)
+    }
+
+    fn from_state(path: PathBuf, state: StoreState) -> Result<Self, HapError> {
+        validate_state(&state)?;
+        let (changes, _) = watch::channel(0);
+        Ok(Self {
+            path,
+            state: RwLock::new(state),
+            pair_setup_active: AtomicBool::new(false),
+            pair_setup_failures: AtomicU16::new(0),
+            changes,
         })
     }
 
-    /// Path used for durable records.
     pub fn path(&self) -> &Path {
         &self.path
     }
 
-    /// Return a deterministic snapshot ordered by controller identifier.
+    pub fn accessory_id(&self) -> Result<String, HapError> {
+        Ok(self.read_state()?.accessory.device_id.clone())
+    }
+
+    pub fn accessory_public_key(&self) -> Result<[u8; 32], HapError> {
+        Ok(self.signing_key()?.verifying_key().to_bytes())
+    }
+
     pub fn list(&self) -> Result<Vec<ControllerPairing>, HapError> {
-        Ok(self
-            .controllers
-            .read()
-            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?
-            .values()
-            .cloned()
-            .collect())
+        Ok(self.read_state()?.controllers.values().cloned().collect())
     }
 
-    /// Look up one controller.
     pub fn get(&self, controller_id: &str) -> Result<Option<ControllerPairing>, HapError> {
-        Ok(self
-            .controllers
-            .read()
-            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?
-            .get(controller_id)
-            .cloned())
+        Ok(self.read_state()?.controllers.get(controller_id).cloned())
     }
 
-    /// Whether at least one controller has completed pairing.
     pub fn is_paired(&self) -> Result<bool, HapError> {
-        Ok(!self
-            .controllers
-            .read()
-            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?
-            .is_empty())
+        Ok(!self.read_state()?.controllers.is_empty())
     }
 
-    /// Add a controller and durably commit it before exposing it in memory.
-    pub fn add(&self, pairing: ControllerPairing) -> Result<(), HapError> {
+    /// Add the first administrator after a fully authenticated Pair-Setup M5.
+    pub(crate) fn add_initial(&self, pairing: ControllerPairing) -> Result<(), HapError> {
         pairing.validate()?;
-        let mut guard = self
-            .controllers
-            .write()
-            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?;
-        if guard.contains_key(&pairing.controller_id) {
-            return Err(HapError::PairingAlreadyExists(pairing.controller_id));
+        if !pairing.admin {
+            return Err(HapError::InvalidPairingRecord(
+                "the first controller must be an administrator".into(),
+            ));
         }
-        let mut next = guard.clone();
-        next.insert(pairing.controller_id.clone(), pairing);
-        persist_file(&self.path, &next)?;
-        *guard = next;
+        self.update(|state| {
+            if !state.controllers.is_empty() {
+                return Err(HapError::PairingAlreadyExists(
+                    pairing.controller_id.clone(),
+                ));
+            }
+            state
+                .controllers
+                .insert(pairing.controller_id.clone(), pairing);
+            Ok(())
+        })?;
+        self.pair_setup_failures.store(0, Ordering::Release);
         Ok(())
     }
 
-    /// Remove a controller, refusing to orphan remaining non-admin pairings.
-    pub fn remove(&self, controller_id: &str) -> Result<(), HapError> {
+    /// Add or update a pairing according to HAP Add Pairing semantics.
+    pub(crate) fn upsert(&self, pairing: ControllerPairing) -> Result<(), HapError> {
+        pairing.validate()?;
+        self.update(|state| {
+            if let Some(existing) = state.controllers.get(&pairing.controller_id) {
+                if existing.public_key != pairing.public_key {
+                    return Err(HapError::InvalidPairingRecord(
+                        "existing pairing public key cannot be replaced".into(),
+                    ));
+                }
+            } else if state.controllers.len() >= MAX_CONTROLLERS {
+                return Err(HapError::PairingCapacity);
+            }
+            state
+                .controllers
+                .insert(pairing.controller_id.clone(), pairing);
+            Ok(())
+        })
+    }
+
+    /// Remove a pairing idempotently. Removing the final administrator clears
+    /// every pairing as required by HAP.
+    pub(crate) fn remove_hap(&self, controller_id: &str) -> Result<bool, HapError> {
+        let mut removed = false;
+        self.update(|state| {
+            removed = state.controllers.remove(controller_id).is_some();
+            if removed
+                && !state.controllers.is_empty()
+                && !state.controllers.values().any(|pairing| pairing.admin)
+            {
+                state.controllers.clear();
+            }
+            Ok(())
+        })?;
+        Ok(removed)
+    }
+
+    pub(crate) fn signing_key(&self) -> Result<SigningKey, HapError> {
+        Ok(SigningKey::from_bytes(
+            &self.read_state()?.accessory.signing_seed,
+        ))
+    }
+
+    pub(crate) fn setup_record(&self) -> Result<([u8; 16], Vec<u8>), HapError> {
+        let state = self.read_state()?;
+        Ok((state.setup.salt, state.setup.verifier.clone()))
+    }
+
+    pub(crate) fn try_begin_pair_setup(&self) -> bool {
+        self.pair_setup_active
+            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+            .is_ok()
+    }
+
+    pub(crate) fn end_pair_setup(&self) {
+        self.pair_setup_active.store(false, Ordering::Release);
+    }
+
+    pub(crate) fn pair_setup_locked_out(&self) -> bool {
+        self.pair_setup_failures.load(Ordering::Acquire) >= MAX_PAIR_SETUP_FAILURES
+    }
+
+    pub(crate) fn record_pair_setup_failure(&self) {
+        let _ = self.pair_setup_failures.fetch_update(
+            Ordering::AcqRel,
+            Ordering::Acquire,
+            |attempts| Some(attempts.saturating_add(1)),
+        );
+    }
+
+    pub(crate) fn subscribe_changes(&self) -> watch::Receiver<u64> {
+        self.changes.subscribe()
+    }
+
+    fn read_state(&self) -> Result<std::sync::RwLockReadGuard<'_, StoreState>, HapError> {
+        self.state
+            .read()
+            .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))
+    }
+
+    fn update(
+        &self,
+        mutate: impl FnOnce(&mut StoreState) -> Result<(), HapError>,
+    ) -> Result<(), HapError> {
         let mut guard = self
-            .controllers
+            .state
             .write()
             .map_err(|_| HapError::PairingStore("pairing store lock poisoned".into()))?;
-        if !guard.contains_key(controller_id) {
-            return Err(HapError::PairingNotFound(controller_id.to_owned()));
-        }
         let mut next = guard.clone();
-        next.remove(controller_id);
-        if !next.is_empty() && !next.values().any(|pairing| pairing.admin) {
-            return Err(HapError::InvalidPairingRecord(
-                "cannot remove the last administrator while pairings remain".into(),
-            ));
-        }
-        persist_file(&self.path, &next)?;
+        mutate(&mut next)?;
+        validate_state(&next)?;
+        persist_file(&self.path, &next, true)?;
         *guard = next;
+        self.changes.send_modify(|revision| *revision += 1);
         Ok(())
     }
 }
 
-fn load_file(path: &Path) -> Result<BTreeMap<String, ControllerPairing>, HapError> {
+fn new_state(setup_code: &SetupCode, device_id: Option<String>) -> Result<StoreState, HapError> {
+    let mut signing_seed = [0u8; 32];
+    let mut salt = [0u8; 16];
+    getrandom::getrandom(&mut signing_seed)
+        .and_then(|_| getrandom::getrandom(&mut salt))
+        .map_err(|error| HapError::PairingStore(format!("generate accessory identity: {error}")))?;
+    let device_id = match device_id {
+        Some(device_id) => device_id,
+        None => generate_device_id()?,
+    };
+    let verifier =
+        ClientG3072::<Sha512>::new().compute_verifier(SRP_USERNAME, setup_code.as_bytes(), &salt);
+    let state = StoreState {
+        accessory: StoredAccessory {
+            device_id,
+            signing_seed,
+        },
+        setup: StoredSetup { salt, verifier },
+        controllers: BTreeMap::new(),
+    };
+    validate_state(&state)?;
+    Ok(state)
+}
+
+fn generate_device_id() -> Result<String, HapError> {
+    let mut bytes = [0u8; 6];
+    getrandom::getrandom(&mut bytes)
+        .map_err(|error| HapError::PairingStore(format!("generate device ID: {error}")))?;
+    Ok(bytes
+        .iter()
+        .map(|byte| format!("{byte:02X}"))
+        .collect::<Vec<_>>()
+        .join(":"))
+}
+
+fn validate_device_id(device_id: &str) -> Result<(), HapError> {
+    let parts: Vec<&str> = device_id.split(':').collect();
+    if parts.len() != 6
+        || parts
+            .iter()
+            .any(|part| part.len() != 2 || !part.bytes().all(|byte| byte.is_ascii_hexdigit()))
+    {
+        return Err(HapError::InvalidPairingRecord(
+            "accessory device ID must be six colon-separated hexadecimal octets".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_state(state: &StoreState) -> Result<(), HapError> {
+    validate_device_id(&state.accessory.device_id)?;
+    SigningKey::from_bytes(&state.accessory.signing_seed);
+    if state.setup.verifier.len() != 384 {
+        return Err(HapError::InvalidPairingRecord(
+            "SRP verifier must contain exactly 384 bytes".into(),
+        ));
+    }
+    if state.controllers.len() > MAX_CONTROLLERS {
+        return Err(HapError::InvalidPairingRecord(
+            "too many persisted controller pairings".into(),
+        ));
+    }
+    for (id, pairing) in &state.controllers {
+        pairing.validate()?;
+        if id != &pairing.controller_id {
+            return Err(HapError::InvalidPairingRecord(
+                "controller map key does not match identifier".into(),
+            ));
+        }
+    }
+    if !state.controllers.is_empty() && !state.controllers.values().any(|pairing| pairing.admin) {
+        return Err(HapError::InvalidPairingRecord(
+            "persisted pairings have no administrator".into(),
+        ));
+    }
+    Ok(())
+}
+
+fn load_file(path: &Path) -> Result<StoreState, HapError> {
     let metadata = fs::symlink_metadata(path)
         .map_err(|error| HapError::PairingStore(format!("metadata {}: {error}", path.display())))?;
     if metadata.file_type().is_symlink() || !metadata.is_file() {
@@ -174,25 +499,23 @@ fn load_file(path: &Path) -> Result<BTreeMap<String, ControllerPairing>, HapErro
         )));
     }
     validate_permissions(path, &metadata)?;
-
-    let mut bytes = Vec::with_capacity(metadata.len() as usize);
+    let mut bytes = Zeroizing::new(Vec::with_capacity(metadata.len() as usize));
     File::open(path)
-        .and_then(|file| file.take(MAX_STORE_BYTES + 1).read_to_end(&mut bytes))
+        .and_then(|file| file.take(MAX_STORE_BYTES + 1).read_to_end(bytes.as_mut()))
         .map_err(|error| HapError::PairingStore(format!("read {}: {error}", path.display())))?;
     if bytes.len() as u64 > MAX_STORE_BYTES {
         return Err(HapError::PairingStore(
             "pairing store exceeds size limit".into(),
         ));
     }
-    let file: PairingFile = serde_json::from_slice(&bytes)
+    let file: PairingFile = serde_json::from_slice(bytes.as_slice())
         .map_err(|error| HapError::PairingStore(format!("parse {}: {error}", path.display())))?;
     if file.version != STORE_VERSION {
         return Err(HapError::PairingStore(format!(
-            "unsupported pairing store version {}",
+            "unsupported pairing store version {}; v1 controller-only stores cannot be used because they lack accessory identity and setup material",
             file.version
         )));
     }
-
     let mut controllers = BTreeMap::new();
     for pairing in file.controllers {
         pairing.validate()?;
@@ -203,31 +526,32 @@ fn load_file(path: &Path) -> Result<BTreeMap<String, ControllerPairing>, HapErro
             )));
         }
     }
-    if !controllers.is_empty() && !controllers.values().any(|pairing| pairing.admin) {
-        return Err(HapError::InvalidPairingRecord(
-            "persisted pairings have no administrator".into(),
-        ));
-    }
-    Ok(controllers)
+    let state = StoreState {
+        accessory: file.accessory,
+        setup: file.setup,
+        controllers,
+    };
+    validate_state(&state)?;
+    Ok(state)
 }
 
-fn persist_file(
-    path: &Path,
-    controllers: &BTreeMap<String, ControllerPairing>,
-) -> Result<(), HapError> {
+fn persist_file(path: &Path, state: &StoreState, overwrite: bool) -> Result<(), HapError> {
     let parent = path
         .parent()
         .filter(|parent| !parent.as_os_str().is_empty())
         .unwrap_or(Path::new("."));
     create_private_dir(parent)?;
-    let payload = serde_json::to_vec_pretty(&PairingFile {
-        version: STORE_VERSION,
-        controllers: controllers.values().cloned().collect(),
-    })
-    .map_err(|error| HapError::PairingStore(format!("serialize pairings: {error}")))?;
-
+    let payload = Zeroizing::new(
+        serde_json::to_vec_pretty(&PairingFile {
+            version: STORE_VERSION,
+            accessory: state.accessory.clone(),
+            setup: state.setup.clone(),
+            controllers: state.controllers.values().cloned().collect(),
+        })
+        .map_err(|error| HapError::PairingStore(format!("serialize pairings: {error}")))?,
+    );
     let mut temp = Builder::new()
-        .prefix(".homecore-hap-pairings-")
+        .prefix(".homecore-hap-security-")
         .tempfile_in(parent)
         .map_err(|error| HapError::PairingStore(format!("create temporary store: {error}")))?;
     set_private_file_permissions(temp.as_file())?;
@@ -235,18 +559,19 @@ fn persist_file(
         .and_then(|_| temp.flush())
         .and_then(|_| temp.as_file().sync_all())
         .map_err(|error| HapError::PairingStore(format!("write temporary store: {error}")))?;
-    temp.persist(path).map_err(|error| {
-        HapError::PairingStore(format!("replace {}: {}", path.display(), error.error))
-    })?;
-
-    #[cfg(unix)]
-    {
-        File::open(parent)
-            .and_then(|directory| directory.sync_all())
-            .map_err(|error| {
-                HapError::PairingStore(format!("sync {}: {error}", parent.display()))
-            })?;
+    if overwrite {
+        temp.persist(path).map_err(|error| {
+            HapError::PairingStore(format!("replace {}: {}", path.display(), error.error))
+        })?;
+    } else {
+        temp.persist_noclobber(path).map_err(|error| {
+            HapError::PairingStore(format!("create {}: {}", path.display(), error.error))
+        })?;
     }
+    #[cfg(unix)]
+    File::open(parent)
+        .and_then(|directory| directory.sync_all())
+        .map_err(|error| HapError::PairingStore(format!("sync {}: {error}", parent.display())))?;
     Ok(())
 }
 
@@ -258,13 +583,11 @@ fn create_private_dir(path: &Path) -> Result<(), HapError> {
         })?;
     }
     #[cfg(unix)]
-    {
+    if created {
         use std::os::unix::fs::PermissionsExt;
-        if created {
-            fs::set_permissions(path, fs::Permissions::from_mode(0o700)).map_err(|error| {
-                HapError::PairingStore(format!("chmod {}: {error}", path.display()))
-            })?;
-        }
+        fs::set_permissions(path, fs::Permissions::from_mode(0o700)).map_err(|error| {
+            HapError::PairingStore(format!("chmod {}: {error}", path.display()))
+        })?;
     }
     Ok(())
 }
@@ -299,28 +622,49 @@ fn validate_permissions(path: &Path, metadata: &fs::Metadata) -> Result<(), HapE
 #[cfg(test)]
 mod tests {
     use super::*;
-    use ed25519_dalek::SigningKey;
+
+    fn store(directory: &tempfile::TempDir) -> PairingStore {
+        PairingStore::create(
+            directory.path().join("pairings.json"),
+            SetupCode::parse("518-26-003").unwrap(),
+            Some("AA:BB:CC:DD:EE:FF".into()),
+        )
+        .unwrap()
+    }
 
     fn pairing(id: &str, byte: u8, admin: bool) -> ControllerPairing {
-        let public_key = SigningKey::from_bytes(&[byte; 32])
-            .verifying_key()
-            .to_bytes();
         ControllerPairing {
             controller_id: id.into(),
-            public_key,
+            public_key: SigningKey::from_bytes(&[byte; 32])
+                .verifying_key()
+                .to_bytes(),
             admin,
         }
     }
 
     #[test]
-    fn restart_loads_atomically_persisted_pairings() {
+    fn first_provisioning_returns_code_but_restart_does_not() {
         let directory = tempfile::tempdir().unwrap();
         let path = directory.path().join("pairings.json");
-        let store = PairingStore::open(&path).unwrap();
-        store.add(pairing("controller-1", 7, true)).unwrap();
-        drop(store);
+        let provisioned = PairingStore::load_or_create(&path).unwrap();
+        let id = provisioned.store.accessory_id().unwrap();
+        assert!(provisioned.setup_code.is_some());
+        drop(provisioned);
+        let reopened = PairingStore::load_or_create(path).unwrap();
+        assert!(reopened.setup_code.is_none());
+        assert_eq!(reopened.store.accessory_id().unwrap(), id);
+    }
 
-        let reopened = PairingStore::open(&path).unwrap();
+    #[test]
+    fn identity_and_pairings_survive_atomic_restart() {
+        let directory = tempfile::tempdir().unwrap();
+        let path = directory.path().join("pairings.json");
+        let store = store(&directory);
+        let public_key = store.accessory_public_key().unwrap();
+        store.add_initial(pairing("controller-1", 7, true)).unwrap();
+        drop(store);
+        let reopened = PairingStore::open(path).unwrap();
+        assert_eq!(reopened.accessory_public_key().unwrap(), public_key);
         assert_eq!(
             reopened.list().unwrap(),
             vec![pairing("controller-1", 7, true)]
@@ -328,10 +672,28 @@ mod tests {
     }
 
     #[test]
-    fn malformed_and_duplicate_records_fail_closed() {
+    fn prohibited_setup_codes_are_rejected_and_debug_is_redacted() {
+        assert!(SetupCode::parse("111-11-111").is_err());
+        assert!(SetupCode::parse("123-45-678").is_err());
+        let code = SetupCode::parse("518-26-003").unwrap();
+        assert_eq!(format!("{code:?}"), "SetupCode([REDACTED])");
+    }
+
+    #[test]
+    fn removing_last_admin_clears_all_pairings() {
+        let directory = tempfile::tempdir().unwrap();
+        let store = store(&directory);
+        store.add_initial(pairing("admin", 1, true)).unwrap();
+        store.upsert(pairing("member", 2, false)).unwrap();
+        assert!(store.remove_hap("admin").unwrap());
+        assert!(store.list().unwrap().is_empty());
+    }
+
+    #[test]
+    fn malformed_or_legacy_records_fail_closed() {
         let directory = tempfile::tempdir().unwrap();
         let path = directory.path().join("pairings.json");
-        fs::write(&path, br#"{"version":1,"controllers":[{"controller_id":"","public_key":[0,1],"admin":true}]}"#).unwrap();
+        fs::write(&path, br#"{"version":1,"controllers":[]}"#).unwrap();
         #[cfg(unix)]
         {
             use std::os::unix::fs::PermissionsExt;
@@ -340,23 +702,13 @@ mod tests {
         assert!(PairingStore::open(path).is_err());
     }
 
-    #[test]
-    fn cannot_remove_last_admin_while_members_remain() {
-        let directory = tempfile::tempdir().unwrap();
-        let store = PairingStore::open(directory.path().join("pairings.json")).unwrap();
-        store.add(pairing("admin", 1, true)).unwrap();
-        store.add(pairing("member", 2, false)).unwrap();
-        assert!(store.remove("admin").is_err());
-        assert_eq!(store.list().unwrap().len(), 2);
-    }
-
     #[cfg(unix)]
     #[test]
     fn permissive_existing_file_is_rejected() {
         use std::os::unix::fs::PermissionsExt;
         let directory = tempfile::tempdir().unwrap();
         let path = directory.path().join("pairings.json");
-        fs::write(&path, br#"{"version":1,"controllers":[]}"#).unwrap();
+        let _ = store(&directory);
         fs::set_permissions(&path, fs::Permissions::from_mode(0o644)).unwrap();
         assert!(matches!(
             PairingStore::open(path),
diff --git a/v2/crates/homecore-hap/src/protocol.rs b/v2/crates/homecore-hap/src/protocol.rs
index 53cdbb8c..33e5e19f 100644
--- a/v2/crates/homecore-hap/src/protocol.rs
+++ b/v2/crates/homecore-hap/src/protocol.rs
@@ -1,4 +1,4 @@
-//! Bounded HAP TLV8 primitives and fail-closed pairing responses.
+//! Bounded HAP TLV8 primitives.
 
 use std::collections::BTreeMap;
 
@@ -6,12 +6,21 @@ use crate::error::HapError;
 
 pub const TLV_METHOD: u8 = 0x00;
 pub const TLV_IDENTIFIER: u8 = 0x01;
+pub const TLV_SALT: u8 = 0x02;
 pub const TLV_PUBLIC_KEY: u8 = 0x03;
+pub const TLV_PROOF: u8 = 0x04;
+pub const TLV_ENCRYPTED_DATA: u8 = 0x05;
 pub const TLV_STATE: u8 = 0x06;
 pub const TLV_ERROR: u8 = 0x07;
 pub const TLV_SIGNATURE: u8 = 0x0a;
+pub const TLV_PERMISSIONS: u8 = 0x0b;
+pub const TLV_FLAGS: u8 = 0x13;
+pub const TLV_SEPARATOR: u8 = 0xff;
 
+pub const TLV_ERROR_UNKNOWN: u8 = 0x01;
 pub const TLV_ERROR_AUTHENTICATION: u8 = 0x02;
+pub const TLV_ERROR_MAX_PEERS: u8 = 0x04;
+pub const TLV_ERROR_MAX_TRIES: u8 = 0x05;
 pub const TLV_ERROR_UNAVAILABLE: u8 = 0x06;
 pub const TLV_ERROR_BUSY: u8 = 0x07;
 
@@ -68,34 +77,37 @@ impl Tlv8 {
     }
 
     pub fn encode(&self) -> Vec<u8> {
-        let mut encoded = Vec::new();
-        for (&kind, value) in &self.values {
-            if value.is_empty() {
-                encoded.extend_from_slice(&[kind, 0]);
-                continue;
-            }
-            for chunk in value.chunks(u8::MAX as usize) {
-                encoded.push(kind);
-                encoded.push(chunk.len() as u8);
-                encoded.extend_from_slice(chunk);
-            }
-        }
-        encoded
+        encode_items(
+            self.values
+                .iter()
+                .map(|(&kind, value)| (kind, value.as_slice())),
+        )
     }
 }
 
-/// Standards-shaped response used while cryptographic pairing phases are
-/// unavailable. It is a real TLV8 error, never a success-shaped placeholder.
-pub fn pairing_unavailable_response(request: &[u8]) -> Result<Vec<u8>, HapError> {
-    let request = Tlv8::parse(request)?;
-    let request_state = request
-        .byte(TLV_STATE)
-        .ok_or_else(|| HapError::Protocol("pairing request lacks one-byte State".into()))?;
-    let response_state = request_state.saturating_add(1);
-    let mut response = Tlv8::default();
-    response.insert(TLV_STATE, vec![response_state]);
-    response.insert(TLV_ERROR, vec![TLV_ERROR_UNAVAILABLE]);
-    Ok(response.encode())
+/// Encode ordered TLV8 items, including repeated items separated by a
+/// zero-length `Separator` for `/pairings` list responses.
+pub fn encode_items<'a>(items: impl IntoIterator<Item = (u8, &'a [u8])>) -> Vec<u8> {
+    let mut encoded = Vec::new();
+    for (kind, value) in items {
+        if value.is_empty() {
+            encoded.extend_from_slice(&[kind, 0]);
+            continue;
+        }
+        for chunk in value.chunks(u8::MAX as usize) {
+            encoded.push(kind);
+            encoded.push(chunk.len() as u8);
+            encoded.extend_from_slice(chunk);
+        }
+    }
+    encoded
+}
+
+pub fn error_response(state: u8, error: u8) -> Vec<u8> {
+    encode_items([
+        (TLV_STATE, [state].as_slice()),
+        (TLV_ERROR, [error].as_slice()),
+    ])
 }
 
 #[cfg(test)]
@@ -120,8 +132,8 @@ mod tests {
     }
 
     #[test]
-    fn unavailable_pairing_is_an_explicit_error_not_success() {
-        let response = pairing_unavailable_response(&[TLV_STATE, 1, 1]).unwrap();
+    fn error_response_is_not_success_shaped() {
+        let response = error_response(2, TLV_ERROR_UNAVAILABLE);
         let decoded = Tlv8::parse(&response).unwrap();
         assert_eq!(decoded.byte(TLV_STATE), Some(2));
         assert_eq!(decoded.byte(TLV_ERROR), Some(TLV_ERROR_UNAVAILABLE));
diff --git a/v2/crates/homecore-hap/src/server.rs b/v2/crates/homecore-hap/src/server.rs
index cf4ae018..0ccecc92 100644
--- a/v2/crates/homecore-hap/src/server.rs
+++ b/v2/crates/homecore-hap/src/server.rs
@@ -1,9 +1,4 @@
-//! Bounded async TCP/HTTP foundation for HAP.
-//!
-//! The listener parses plaintext pairing HTTP and has authenticated accessory
-//! endpoint handlers ready for a future encrypted transport. Because Pair-
-//! Setup, Pair-Verify, and HAP frame encryption are not complete, no network
-//! request can currently transition a session to authenticated.
+//! Bounded HAP IP server with plaintext pairing and encrypted control sessions.
 
 use std::collections::HashSet;
 use std::net::SocketAddr;
@@ -14,16 +9,23 @@ use httparse::Status;
 use serde_json::{json, Value};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
-use tokio::sync::{oneshot, Semaphore};
+use tokio::sync::{oneshot, Mutex, Semaphore};
 use tokio::task::{JoinHandle, JoinSet};
 use tokio::time::{timeout, Instant};
 
 use crate::accessory::{HapAccessoryType, HapCharacteristic, HapCharacteristicValue};
 use crate::bridge::{CharacteristicEvent, ExposedAccessory, HapBridge};
+use crate::crypto::{RecordLayer, RECORD_TAG_BYTES};
 use crate::error::HapError;
-use crate::mdns::MdnsAdvertiser;
-use crate::pairing::PairingStore;
-use crate::protocol::pairing_unavailable_response;
+use crate::mdns::{HapServiceRecord, MdnsAdvertiser};
+use crate::pair_setup::PairSetup;
+use crate::pair_verify::PairVerify;
+use crate::pairing::{ControllerPairing, PairingStore};
+use crate::protocol::{
+    encode_items, error_response as tlv_error_response, Tlv8, TLV_ERROR_AUTHENTICATION,
+    TLV_ERROR_MAX_PEERS, TLV_ERROR_UNKNOWN, TLV_IDENTIFIER, TLV_METHOD, TLV_PERMISSIONS,
+    TLV_PUBLIC_KEY, TLV_SEPARATOR, TLV_STATE,
+};
 use crate::session::Session;
 
 const HAP_JSON: &str = "application/hap+json";
@@ -133,8 +135,19 @@ pub async fn start_server(
 
     let mut record = bridge.service_record.clone();
     record.port = local_addr.port();
+    let persisted_id = pairings.accessory_id()?;
+    if !record.device_id.eq_ignore_ascii_case(&persisted_id) {
+        return Err(HapError::Server(format!(
+            "mDNS device ID {} does not match persisted accessory identity {persisted_id}",
+            record.device_id
+        )));
+    }
     record.paired = pairings.is_paired()?;
     advertiser.advertise(&record).await?;
+    let discovery = Arc::new(DiscoveryState {
+        advertiser,
+        record: Mutex::new(record),
+    });
 
     let (shutdown_tx, shutdown_rx) = oneshot::channel();
     let task_config = config.clone();
@@ -143,8 +156,7 @@ pub async fn start_server(
         task_config,
         bridge,
         pairings,
-        advertiser,
-        record.instance_name,
+        discovery,
         shutdown_rx,
     ));
     Ok(HapServerHandle {
@@ -164,8 +176,7 @@ async fn run_listener(
     config: HapServerConfig,
     bridge: HapBridge,
     pairings: Arc<PairingStore>,
-    advertiser: Arc<dyn MdnsAdvertiser>,
-    instance_name: String,
+    discovery: Arc<DiscoveryState>,
     mut shutdown: oneshot::Receiver<()>,
 ) -> Result<(), HapError> {
     let permits = Arc::new(Semaphore::new(config.max_connections));
@@ -189,11 +200,12 @@ async fn run_listener(
             Ok((stream, peer)) => {
                 let bridge = bridge.clone();
                 let pairings = pairings.clone();
+                let discovery = discovery.clone();
                 let limits = config.clone();
                 connections.spawn(async move {
                     let _permit = permit;
                     if let Err(error) =
-                        serve_connection(stream, peer, limits, bridge, pairings).await
+                        serve_connection(stream, peer, limits, bridge, pairings, discovery).await
                     {
                         tracing::debug!(%peer, %error, "HAP connection closed");
                     }
@@ -216,7 +228,32 @@ async fn run_listener(
             break;
         }
     }
-    advertiser.retract(&instance_name).await
+    discovery.retract().await
+}
+
+struct DiscoveryState {
+    advertiser: Arc<dyn MdnsAdvertiser>,
+    record: Mutex<HapServiceRecord>,
+}
+
+impl DiscoveryState {
+    async fn set_paired(&self, paired: bool) -> Result<(), HapError> {
+        let mut record = self.record.lock().await;
+        if record.paired == paired {
+            return Ok(());
+        }
+        self.advertiser.retract(&record.instance_name).await?;
+        let mut next = record.clone();
+        next.paired = paired;
+        self.advertiser.advertise(&next).await?;
+        *record = next;
+        Ok(())
+    }
+
+    async fn retract(&self) -> Result<(), HapError> {
+        let record = self.record.lock().await;
+        self.advertiser.retract(&record.instance_name).await
+    }
 }
 
 async fn serve_connection(
@@ -225,41 +262,62 @@ async fn serve_connection(
     config: HapServerConfig,
     bridge: HapBridge,
     pairings: Arc<PairingStore>,
+    discovery: Arc<DiscoveryState>,
 ) -> Result<(), HapError> {
     let mut buffer = ConnectionBuffer::default();
     let mut session = Session::new();
+    let mut pair_setup = PairSetup::new(pairings.clone());
+    let mut pair_verify = PairVerify::new(pairings.clone());
+    let mut record_layer = None;
     let mut subscriptions = HashSet::new();
     let mut events = bridge.subscribe_events();
+    let mut pairing_changes = pairings.subscribe_changes();
 
     loop {
         tokio::select! {
             request = timeout(
                 config.request_timeout,
-                read_request(&mut stream, &mut buffer, &config),
+                read_request(&mut stream, &mut record_layer, &mut buffer, &config),
             ) => {
                 let request = match request {
                     Ok(Ok(Some(request))) => request,
                     Ok(Ok(None)) => break,
+                    Ok(Err(RequestReadError::Authentication)) => break,
                     Ok(Err(error)) => {
                         let response = error_response(&error);
-                        write_response(&mut stream, response).await?;
+                        write_response(&mut stream, record_layer.as_mut(), response).await?;
                         break;
                     }
                     Err(_) => {
-                        write_response(&mut stream, Response::plain(408, b"request timeout".to_vec())).await?;
+                        write_response(
+                            &mut stream,
+                            record_layer.as_mut(),
+                            Response::plain(408, b"request timeout".to_vec()),
+                        ).await?;
                         break;
                     }
                 };
                 let close = request.connection_close;
-                let response = dispatch_request(
+                let dispatched = dispatch_request(
                     request,
                     &mut session,
+                    (&mut pair_setup, &mut pair_verify),
                     &bridge,
                     &pairings,
+                    &discovery,
                     &mut subscriptions,
-                );
-                write_response(&mut stream, response).await?;
-                if close {
+                ).await;
+                write_response(
+                    &mut stream,
+                    record_layer.as_mut(),
+                    dispatched.response,
+                ).await?;
+                if record_layer.is_none() {
+                    if let Some(keys) = session.take_session_keys() {
+                        record_layer = Some(RecordLayer::accessory(keys));
+                    }
+                }
+                if close || dispatched.close_after_response {
                     break;
                 }
             }
@@ -267,7 +325,10 @@ async fn serve_connection(
                 match event {
                     Ok(event) => {
                         if let Some(payload) = event_payload(&bridge, &event, &subscriptions) {
-                            write_event(&mut stream, payload).await?;
+                            let Some(records) = record_layer.as_mut() else {
+                                break;
+                            };
+                            write_event(&mut stream, records, payload).await?;
                         }
                     }
                     Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
@@ -276,6 +337,17 @@ async fn serve_connection(
                     Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
                 }
             }
+            changed = pairing_changes.changed(), if session.state().is_authenticated() => {
+                if changed.is_err() {
+                    break;
+                }
+                let Some(controller_id) = session.controller_id() else {
+                    break;
+                };
+                if pairings.get(controller_id)?.is_none() {
+                    break;
+                }
+            }
         }
     }
     session.close();
@@ -297,6 +369,7 @@ struct ConnectionBuffer {
 
 async fn read_request(
     stream: &mut TcpStream,
+    record_layer: &mut Option<RecordLayer>,
     buffer: &mut ConnectionBuffer,
     config: &HapServerConfig,
 ) -> Result<Option<Request>, RequestReadError> {
@@ -307,19 +380,15 @@ async fn read_request(
         if buffer.bytes.len() >= config.max_header_bytes {
             return Err(RequestReadError::HeadersTooLarge);
         }
-        let mut chunk = [0u8; 2048];
-        let read = stream
-            .read(&mut chunk)
-            .await
-            .map_err(RequestReadError::Io)?;
-        if read == 0 {
+        let chunk = read_transport_chunk(stream, record_layer).await?;
+        if chunk.is_empty() {
             return if buffer.bytes.is_empty() {
                 Ok(None)
             } else {
                 Err(RequestReadError::Malformed("truncated HTTP headers"))
             };
         }
-        buffer.bytes.extend_from_slice(&chunk[..read]);
+        buffer.bytes.extend_from_slice(&chunk);
     };
     if header_end > config.max_header_bytes {
         return Err(RequestReadError::HeadersTooLarge);
@@ -381,16 +450,11 @@ async fn read_request(
         .checked_add(content_length)
         .ok_or(RequestReadError::BodyTooLarge)?;
     while buffer.bytes.len() < request_end {
-        let remaining = request_end - buffer.bytes.len();
-        let mut chunk = vec![0u8; remaining.min(8192)];
-        let read = stream
-            .read(&mut chunk)
-            .await
-            .map_err(RequestReadError::Io)?;
-        if read == 0 {
+        let chunk = read_transport_chunk(stream, record_layer).await?;
+        if chunk.is_empty() {
             return Err(RequestReadError::Malformed("truncated HTTP body"));
         }
-        buffer.bytes.extend_from_slice(&chunk[..read]);
+        buffer.bytes.extend_from_slice(&chunk);
     }
     let body = buffer.bytes[header_end..request_end].to_vec();
     buffer.bytes.drain(..request_end);
@@ -402,6 +466,46 @@ async fn read_request(
     }))
 }
 
+async fn read_transport_chunk(
+    stream: &mut TcpStream,
+    record_layer: &mut Option<RecordLayer>,
+) -> Result<Vec<u8>, RequestReadError> {
+    let Some(records) = record_layer.as_mut() else {
+        let mut chunk = vec![0u8; 2048];
+        let read = stream
+            .read(&mut chunk)
+            .await
+            .map_err(RequestReadError::Io)?;
+        chunk.truncate(read);
+        return Ok(chunk);
+    };
+
+    let mut length_bytes = [0u8; 2];
+    let first = stream
+        .read(&mut length_bytes[..1])
+        .await
+        .map_err(RequestReadError::Io)?;
+    if first == 0 {
+        return Ok(Vec::new());
+    }
+    stream
+        .read_exact(&mut length_bytes[1..])
+        .await
+        .map_err(|_| RequestReadError::Authentication)?;
+    let length = u16::from_le_bytes(length_bytes) as usize;
+    if length > crate::crypto::MAX_RECORD_PLAINTEXT {
+        return Err(RequestReadError::Authentication);
+    }
+    let mut encrypted = vec![0u8; length + RECORD_TAG_BYTES];
+    stream
+        .read_exact(&mut encrypted)
+        .await
+        .map_err(|_| RequestReadError::Authentication)?;
+    records
+        .decrypt(length_bytes, &encrypted)
+        .map_err(|_| RequestReadError::Authentication)
+}
+
 fn find_header_end(bytes: &[u8]) -> Option<usize> {
     bytes.windows(4).position(|window| window == b"\r\n\r\n")
 }
@@ -413,6 +517,7 @@ enum RequestReadError {
     MalformedOwned(String),
     HeadersTooLarge,
     BodyTooLarge,
+    Authentication,
 }
 
 impl std::fmt::Display for RequestReadError {
@@ -423,6 +528,7 @@ impl std::fmt::Display for RequestReadError {
             Self::MalformedOwned(message) => formatter.write_str(message),
             Self::HeadersTooLarge => formatter.write_str("HTTP headers too large"),
             Self::BodyTooLarge => formatter.write_str("HTTP body too large"),
+            Self::Authentication => formatter.write_str("encrypted HAP record rejected"),
         }
     }
 }
@@ -459,60 +565,245 @@ impl Response {
     }
 }
 
-fn dispatch_request(
+struct DispatchResult {
+    response: Response,
+    close_after_response: bool,
+}
+
+impl DispatchResult {
+    fn keep(response: Response) -> Self {
+        Self {
+            response,
+            close_after_response: false,
+        }
+    }
+
+    fn close(response: Response) -> Self {
+        Self {
+            response,
+            close_after_response: true,
+        }
+    }
+}
+
+async fn dispatch_request(
     request: Request,
     session: &mut Session,
+    pair_protocols: (&mut PairSetup, &mut PairVerify),
     bridge: &HapBridge,
-    pairings: &PairingStore,
+    pairings: &Arc<PairingStore>,
+    discovery: &DiscoveryState,
     subscriptions: &mut HashSet<(u64, u64)>,
-) -> Response {
+) -> DispatchResult {
+    let (pair_setup, pair_verify) = pair_protocols;
     match (
         request.method.as_str(),
         request.target.split('?').next().unwrap_or(""),
     ) {
         ("POST", "/pair-setup") => {
-            let _ = session.begin_pair_setup(pairings.is_paired().unwrap_or(true));
-            let response = pairing_unavailable_response(&request.body);
-            let _ = session.reset_pairing();
-            match response {
-                Ok(body) => Response {
-                    status: 200,
-                    content_type: HAP_TLV,
-                    body,
-                },
-                Err(error) => Response::plain(400, error.to_string().into_bytes()),
+            if request_state(&request.body) == Some(1) && session.begin_pair_setup().is_err() {
+                return DispatchResult::close(Response::plain(
+                    400,
+                    b"invalid Pair-Setup session transition".to_vec(),
+                ));
+            }
+            match pair_setup.handle(&request.body) {
+                Ok(result) => {
+                    if result.paired {
+                        if let Err(error) = discovery.set_paired(true).await {
+                            tracing::warn!(%error, "paired state persisted but mDNS update failed");
+                        }
+                    }
+                    if result.terminal {
+                        let _ = session.reset_pairing();
+                    }
+                    DispatchResult::keep(Response {
+                        status: 200,
+                        content_type: HAP_TLV,
+                        body: result.body,
+                    })
+                }
+                Err(error) => {
+                    DispatchResult::close(Response::plain(400, error.to_string().into_bytes()))
+                }
             }
         }
         ("POST", "/pair-verify") => {
-            let _ = session.begin_pair_verify();
-            let response = pairing_unavailable_response(&request.body);
-            let _ = session.reset_pairing();
-            match response {
-                Ok(body) => Response {
-                    status: 200,
-                    content_type: HAP_TLV,
-                    body,
-                },
-                Err(error) => Response::plain(400, error.to_string().into_bytes()),
+            if request_state(&request.body) == Some(1) && session.begin_pair_verify().is_err() {
+                return DispatchResult::close(Response::plain(
+                    400,
+                    b"invalid Pair-Verify session transition".to_vec(),
+                ));
+            }
+            match pair_verify.handle(&request.body) {
+                Ok(result) => {
+                    if let Some(authenticated) = result.authenticated {
+                        if let Err(error) = session.authenticate(
+                            authenticated.controller_id,
+                            authenticated.admin,
+                            authenticated.keys,
+                        ) {
+                            return DispatchResult::close(Response::plain(
+                                400,
+                                error.to_string().into_bytes(),
+                            ));
+                        }
+                    } else if result.terminal {
+                        let _ = session.reset_pairing();
+                    }
+                    DispatchResult::keep(Response {
+                        status: 200,
+                        content_type: HAP_TLV,
+                        body: result.body,
+                    })
+                }
+                Err(error) => {
+                    DispatchResult::close(Response::plain(400, error.to_string().into_bytes()))
+                }
             }
         }
-        _ if !session.state().is_authenticated() => Response::json(
+        _ if !session.state().is_authenticated() => DispatchResult::keep(Response::json(
             470,
             json!({"status": -70401, "message": "Connection Authorization Required"}),
-        ),
-        ("GET", "/accessories") => Response::json(200, accessories_json(bridge)),
-        ("GET", "/characteristics") => characteristics_response(&request.target, bridge),
-        ("PUT", "/characteristics") => {
-            characteristic_subscription_response(&request.body, subscriptions)
+        )),
+        ("GET", "/accessories") => {
+            DispatchResult::keep(Response::json(200, accessories_json(bridge)))
         }
-        ("POST", "/pairings") => Response::json(
-            501,
-            json!({"status": -70406, "message": "Pairings management awaits encrypted transport"}),
-        ),
-        _ => Response::plain(404, b"not found".to_vec()),
+        ("GET", "/characteristics") => {
+            DispatchResult::keep(characteristics_response(&request.target, bridge))
+        }
+        ("PUT", "/characteristics") => DispatchResult::keep(characteristic_subscription_response(
+            &request.body,
+            subscriptions,
+        )),
+        ("POST", "/pairings") => {
+            pairings_response(&request.body, session, pairings, discovery).await
+        }
+        _ => DispatchResult::keep(Response::plain(404, b"not found".to_vec())),
     }
 }
 
+fn request_state(body: &[u8]) -> Option<u8> {
+    Tlv8::parse(body).ok()?.byte(TLV_STATE)
+}
+
+async fn pairings_response(
+    body: &[u8],
+    session: &Session,
+    pairings: &PairingStore,
+    discovery: &DiscoveryState,
+) -> DispatchResult {
+    let response = |body| Response {
+        status: 200,
+        content_type: HAP_TLV,
+        body,
+    };
+    let Some(controller_id) = session.controller_id() else {
+        return DispatchResult::close(response(tlv_error_response(2, TLV_ERROR_AUTHENTICATION)));
+    };
+    let authorized = pairings
+        .get(controller_id)
+        .ok()
+        .flatten()
+        .is_some_and(|pairing| pairing.admin);
+    if !authorized {
+        return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_AUTHENTICATION)));
+    }
+    let Ok(tlv) = Tlv8::parse(body) else {
+        return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+    };
+    if tlv.byte(TLV_STATE) != Some(1) {
+        return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+    }
+
+    match tlv.byte(TLV_METHOD) {
+        Some(3) => {
+            let Some(identifier) = pairing_identifier(&tlv) else {
+                return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+            };
+            let Some(public_key) = tlv
+                .get(TLV_PUBLIC_KEY)
+                .and_then(|value| <[u8; 32]>::try_from(value).ok())
+            else {
+                return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+            };
+            let Some(admin) = tlv
+                .byte(TLV_PERMISSIONS)
+                .and_then(|permission| match permission {
+                    0 => Some(false),
+                    1 => Some(true),
+                    _ => None,
+                })
+            else {
+                return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+            };
+            let pairing = ControllerPairing {
+                controller_id: identifier,
+                public_key,
+                admin,
+            };
+            match pairings.upsert(pairing) {
+                Ok(()) => {
+                    DispatchResult::keep(response(encode_items([(TLV_STATE, [2].as_slice())])))
+                }
+                Err(HapError::PairingCapacity) => {
+                    DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_MAX_PEERS)))
+                }
+                Err(_) => DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN))),
+            }
+        }
+        Some(4) => {
+            let Some(identifier) = pairing_identifier(&tlv) else {
+                return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+            };
+            if pairings.remove_hap(&identifier).is_err() {
+                return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+            }
+            let paired = pairings.is_paired().unwrap_or(true);
+            if let Err(error) = discovery.set_paired(paired).await {
+                tracing::warn!(%error, "pairing removal persisted but mDNS update failed");
+            }
+            let removed_current = pairings.get(controller_id).ok().flatten().is_none();
+            let result = response(encode_items([(TLV_STATE, [2].as_slice())]));
+            if removed_current {
+                DispatchResult::close(result)
+            } else {
+                DispatchResult::keep(result)
+            }
+        }
+        Some(5) => {
+            let Ok(records) = pairings.list() else {
+                return DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN)));
+            };
+            let mut body = encode_items([(TLV_STATE, [2].as_slice())]);
+            for (index, pairing) in records.iter().enumerate() {
+                if index != 0 {
+                    body.extend_from_slice(&[TLV_SEPARATOR, 0]);
+                }
+                body.extend_from_slice(&encode_items([
+                    (TLV_IDENTIFIER, pairing.controller_id.as_bytes()),
+                    (TLV_PUBLIC_KEY, pairing.public_key.as_slice()),
+                    (TLV_PERMISSIONS, [u8::from(pairing.admin)].as_slice()),
+                ]));
+            }
+            DispatchResult::keep(response(body))
+        }
+        _ => DispatchResult::keep(response(tlv_error_response(2, TLV_ERROR_UNKNOWN))),
+    }
+}
+
+fn pairing_identifier(tlv: &Tlv8) -> Option<String> {
+    let value = tlv.get(TLV_IDENTIFIER)?;
+    if value.is_empty() || value.len() > 64 {
+        return None;
+    }
+    let identifier = std::str::from_utf8(value).ok()?;
+    if identifier.chars().any(char::is_control) {
+        return None;
+    }
+    Some(identifier.to_owned())
+}
+
 fn accessories_json(bridge: &HapBridge) -> Value {
     let accessories = indexed_accessories(bridge);
     let mut output = vec![json!({
@@ -715,7 +1006,11 @@ fn characteristic_type(kind: HapCharacteristic) -> &'static str {
     }
 }
 
-async fn write_response(stream: &mut TcpStream, response: Response) -> Result<(), HapError> {
+async fn write_response(
+    stream: &mut TcpStream,
+    records: Option<&mut RecordLayer>,
+    response: Response,
+) -> Result<(), HapError> {
     let reason = match response.status {
         200 => "OK",
         204 => "No Content",
@@ -726,47 +1021,60 @@ async fn write_response(stream: &mut TcpStream, response: Response) -> Result<()
         413 => "Payload Too Large",
         431 => "Request Header Fields Too Large",
         470 => "Connection Authorization Required",
-        501 => "Not Implemented",
         _ => "Error",
     };
-    let header = format!(
+    let mut message = format!(
         "HTTP/1.1 {} {}\r\nContent-Type: {}\r\nContent-Length: {}\r\n\r\n",
         response.status,
         reason,
         response.content_type,
         response.body.len()
-    );
-    stream
-        .write_all(header.as_bytes())
-        .await
-        .map_err(|error| HapError::Server(format!("write response header: {error}")))?;
-    stream
-        .write_all(&response.body)
-        .await
-        .map_err(|error| HapError::Server(format!("write response body: {error}")))
+    )
+    .into_bytes();
+    message.extend_from_slice(&response.body);
+    write_transport(stream, records, &message).await
 }
 
-async fn write_event(stream: &mut TcpStream, body: Vec<u8>) -> Result<(), HapError> {
-    let header = format!(
+async fn write_event(
+    stream: &mut TcpStream,
+    records: &mut RecordLayer,
+    body: Vec<u8>,
+) -> Result<(), HapError> {
+    let mut message = format!(
         "EVENT/1.0 200 OK\r\nContent-Type: {HAP_JSON}\r\nContent-Length: {}\r\n\r\n",
         body.len()
-    );
+    )
+    .into_bytes();
+    message.extend_from_slice(&body);
+    write_transport(stream, Some(records), &message).await
+}
+
+async fn write_transport(
+    stream: &mut TcpStream,
+    records: Option<&mut RecordLayer>,
+    plaintext: &[u8],
+) -> Result<(), HapError> {
+    let output = match records {
+        Some(records) => records.encrypt(plaintext)?,
+        None => plaintext.to_vec(),
+    };
     stream
-        .write_all(header.as_bytes())
+        .write_all(&output)
         .await
-        .map_err(|error| HapError::Server(format!("write event header: {error}")))?;
-    stream
-        .write_all(&body)
-        .await
-        .map_err(|error| HapError::Server(format!("write event body: {error}")))
+        .map_err(|error| HapError::Server(format!("write HAP transport: {error}")))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::crypto::{hkdf_sha512, open_labeled, seal_labeled, SessionKeys};
     use crate::mdns::{HapServiceRecord, NullAdvertiser};
+    use crate::pairing::SetupCode;
+    use crate::protocol::{TLV_ENCRYPTED_DATA, TLV_SIGNATURE};
+    use ed25519_dalek::{Signature, Signer, SigningKey, VerifyingKey};
     use homecore::entity::{EntityId, State};
     use homecore::event::Context;
+    use x25519_dalek::{PublicKey, StaticSecret};
 
     fn bridge() -> HapBridge {
         let bridge = HapBridge::new(HapServiceRecord::bridge(
@@ -787,8 +1095,14 @@ mod tests {
 
     async fn server() -> (HapServerHandle, tempfile::TempDir) {
         let directory = tempfile::tempdir().unwrap();
-        let pairings =
-            Arc::new(PairingStore::open(directory.path().join("pairings.json")).unwrap());
+        let pairings = Arc::new(
+            PairingStore::create(
+                directory.path().join("pairings.json"),
+                SetupCode::parse("518-26-003").unwrap(),
+                Some("AA:BB:CC:DD:EE:FF".into()),
+            )
+            .unwrap(),
+        );
         let config = HapServerConfig {
             bind_addr: "127.0.0.1:0".parse().unwrap(),
             request_timeout: Duration::from_secs(1),
@@ -810,6 +1124,96 @@ mod tests {
         response
     }
 
+    async fn paired_server() -> (HapServerHandle, tempfile::TempDir, SigningKey) {
+        let directory = tempfile::tempdir().unwrap();
+        let pairings = Arc::new(
+            PairingStore::create(
+                directory.path().join("pairings.json"),
+                SetupCode::parse("518-26-003").unwrap(),
+                Some("AA:BB:CC:DD:EE:FF".into()),
+            )
+            .unwrap(),
+        );
+        let controller = SigningKey::from_bytes(&[0x42; 32]);
+        pairings
+            .add_initial(ControllerPairing {
+                controller_id: "network-controller".into(),
+                public_key: controller.verifying_key().to_bytes(),
+                admin: true,
+            })
+            .unwrap();
+        let config = HapServerConfig {
+            bind_addr: "127.0.0.1:0".parse().unwrap(),
+            request_timeout: Duration::from_secs(1),
+            shutdown_timeout: Duration::from_secs(1),
+            ..HapServerConfig::default()
+        };
+        let handle = start_server(config, bridge(), pairings, Arc::new(NullAdvertiser))
+            .await
+            .unwrap();
+        (handle, directory, controller)
+    }
+
+    async fn post_tlv(stream: &mut TcpStream, path: &str, body: &[u8]) -> Vec<u8> {
+        let request = format!(
+            "POST {path} HTTP/1.1\r\nHost: localhost\r\nContent-Type: {HAP_TLV}\r\nContent-Length: {}\r\n\r\n",
+            body.len()
+        );
+        stream.write_all(request.as_bytes()).await.unwrap();
+        stream.write_all(body).await.unwrap();
+        read_plain_http(stream).await
+    }
+
+    async fn read_plain_http(stream: &mut TcpStream) -> Vec<u8> {
+        let mut response = Vec::new();
+        while find_header_end(&response).is_none() {
+            let mut byte = [0u8; 1];
+            stream.read_exact(&mut byte).await.unwrap();
+            response.push(byte[0]);
+        }
+        let header_end = find_header_end(&response).unwrap() + 4;
+        let header = std::str::from_utf8(&response[..header_end]).unwrap();
+        let length = header
+            .lines()
+            .find_map(|line| {
+                line.strip_prefix("Content-Length: ")
+                    .and_then(|value| value.parse::<usize>().ok())
+            })
+            .unwrap();
+        response.resize(header_end + length, 0);
+        stream
+            .read_exact(&mut response[header_end..])
+            .await
+            .unwrap();
+        response
+    }
+
+    async fn read_encrypted_http(stream: &mut TcpStream, records: &mut RecordLayer) -> Vec<u8> {
+        let mut plaintext = Vec::new();
+        loop {
+            let mut length = [0u8; 2];
+            stream.read_exact(&mut length).await.unwrap();
+            let payload_length = u16::from_le_bytes(length) as usize;
+            let mut encrypted = vec![0u8; payload_length + RECORD_TAG_BYTES];
+            stream.read_exact(&mut encrypted).await.unwrap();
+            plaintext.extend_from_slice(&records.decrypt(length, &encrypted).unwrap());
+            if let Some(header_position) = find_header_end(&plaintext) {
+                let header_end = header_position + 4;
+                let header = std::str::from_utf8(&plaintext[..header_end]).unwrap();
+                let content_length = header
+                    .lines()
+                    .find_map(|line| {
+                        line.strip_prefix("Content-Length: ")
+                            .and_then(|value| value.parse::<usize>().ok())
+                    })
+                    .unwrap();
+                if plaintext.len() >= header_end + content_length {
+                    return plaintext;
+                }
+            }
+        }
+    }
+
     #[tokio::test]
     async fn lifecycle_binds_and_shuts_down() {
         let (server, _directory) = server().await;
@@ -840,15 +1244,108 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn pairing_endpoint_returns_explicit_unavailable_tlv() {
+    async fn pair_setup_m1_returns_real_srp_challenge() {
         let (server, _directory) = server().await;
         let response = exchange(
             server.local_addr(),
-            b"POST /pair-setup HTTP/1.1\r\nHost: localhost\r\nContent-Length: 3\r\nConnection: close\r\n\r\n\x06\x01\x01",
+            b"POST /pair-setup HTTP/1.1\r\nHost: localhost\r\nContent-Length: 6\r\nConnection: close\r\n\r\n\x00\x01\x00\x06\x01\x01",
         )
         .await;
         assert!(response.starts_with(b"HTTP/1.1 200"));
-        assert!(response.ends_with(b"\x06\x01\x02\x07\x01\x06"));
+        let body_start = find_header_end(&response).unwrap() + 4;
+        let tlv = Tlv8::parse(&response[body_start..]).unwrap();
+        assert_eq!(tlv.byte(TLV_STATE), Some(2));
+        assert_eq!(tlv.get(crate::protocol::TLV_SALT).unwrap().len(), 16);
+        assert_eq!(tlv.get(TLV_PUBLIC_KEY).unwrap().len(), 384);
+        server.shutdown().await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn pair_verify_enables_encrypted_access_and_replay_closes_connection() {
+        let (server, _directory, controller_signing) = paired_server().await;
+        let mut stream = TcpStream::connect(server.local_addr()).await.unwrap();
+        let controller_secret = StaticSecret::from([0x24; 32]);
+        let controller_public = PublicKey::from(&controller_secret).to_bytes();
+        let m1 = encode_items([
+            (TLV_STATE, [1].as_slice()),
+            (TLV_PUBLIC_KEY, controller_public.as_slice()),
+        ]);
+        let m2_http = post_tlv(&mut stream, "/pair-verify", &m1).await;
+        let m2 = Tlv8::parse(&m2_http[find_header_end(&m2_http).unwrap() + 4..]).unwrap();
+        assert_eq!(m2.byte(TLV_STATE), Some(2));
+        let accessory_public: [u8; 32] = m2.get(TLV_PUBLIC_KEY).unwrap().try_into().unwrap();
+        let shared = controller_secret.diffie_hellman(&PublicKey::from(accessory_public));
+        let verify_key = hkdf_sha512(
+            b"Pair-Verify-Encrypt-Salt",
+            shared.as_bytes(),
+            b"Pair-Verify-Encrypt-Info",
+        )
+        .unwrap();
+        let accessory_data = Tlv8::parse(
+            &open_labeled(
+                &verify_key,
+                b"PV-Msg02",
+                m2.get(TLV_ENCRYPTED_DATA).unwrap(),
+            )
+            .unwrap(),
+        )
+        .unwrap();
+        let accessory_id = accessory_data.get(TLV_IDENTIFIER).unwrap();
+        let accessory_signature: [u8; 64] = accessory_data
+            .get(TLV_SIGNATURE)
+            .unwrap()
+            .try_into()
+            .unwrap();
+        let mut accessory_info = Vec::new();
+        accessory_info.extend_from_slice(&accessory_public);
+        accessory_info.extend_from_slice(accessory_id);
+        accessory_info.extend_from_slice(&controller_public);
+        let persisted = PairingStore::open(_directory.path().join("pairings.json")).unwrap();
+        VerifyingKey::from_bytes(&persisted.accessory_public_key().unwrap())
+            .unwrap()
+            .verify_strict(
+                &accessory_info,
+                &Signature::from_bytes(&accessory_signature),
+            )
+            .unwrap();
+
+        let controller_id = b"network-controller";
+        let mut controller_info = Vec::new();
+        controller_info.extend_from_slice(&controller_public);
+        controller_info.extend_from_slice(controller_id);
+        controller_info.extend_from_slice(&accessory_public);
+        let signature = controller_signing.sign(&controller_info).to_bytes();
+        let sub_tlv = encode_items([
+            (TLV_IDENTIFIER, controller_id.as_slice()),
+            (TLV_SIGNATURE, signature.as_slice()),
+        ]);
+        let encrypted = seal_labeled(&verify_key, b"PV-Msg03", &sub_tlv).unwrap();
+        let m3 = encode_items([
+            (TLV_STATE, [3].as_slice()),
+            (TLV_ENCRYPTED_DATA, encrypted.as_slice()),
+        ]);
+        let m4_http = post_tlv(&mut stream, "/pair-verify", &m3).await;
+        let m4 = Tlv8::parse(&m4_http[find_header_end(&m4_http).unwrap() + 4..]).unwrap();
+        assert_eq!(m4.byte(TLV_STATE), Some(4));
+
+        let keys = SessionKeys::derive(shared.as_bytes())
+            .unwrap()
+            .controller_view();
+        let mut records = RecordLayer::controller(keys);
+        let request = b"GET /accessories HTTP/1.1\r\nHost: localhost\r\nContent-Length: 0\r\n\r\n";
+        let encrypted_request = records.encrypt(request).unwrap();
+        stream.write_all(&encrypted_request).await.unwrap();
+        let response = read_encrypted_http(&mut stream, &mut records).await;
+        assert!(response.starts_with(b"HTTP/1.1 200"));
+        assert!(response.windows(11).any(|window| window == b"accessories"));
+
+        stream.write_all(&encrypted_request).await.unwrap();
+        let mut byte = [0u8; 1];
+        let read = timeout(Duration::from_secs(2), stream.read(&mut byte))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(read, 0);
         server.shutdown().await.unwrap();
     }
 
@@ -870,12 +1367,32 @@ mod tests {
         server.shutdown().await.unwrap();
     }
 
-    #[test]
-    fn authenticated_internal_dispatch_exposes_accessories_and_events() {
+    #[tokio::test]
+    async fn authenticated_internal_dispatch_exposes_accessories_and_events() {
         let bridge = bridge();
         let directory = tempfile::tempdir().unwrap();
-        let pairings = PairingStore::open(directory.path().join("pairings.json")).unwrap();
+        let pairings = Arc::new(
+            PairingStore::create(
+                directory.path().join("pairings.json"),
+                SetupCode::parse("518-26-003").unwrap(),
+                Some("AA:BB:CC:DD:EE:FF".into()),
+            )
+            .unwrap(),
+        );
+        pairings
+            .add_initial(ControllerPairing {
+                controller_id: "test-controller".into(),
+                public_key: SigningKey::from_bytes(&[7; 32]).verifying_key().to_bytes(),
+                admin: true,
+            })
+            .unwrap();
         let mut session = Session::authenticated_for_test(true);
+        let mut pair_setup = PairSetup::new(pairings.clone());
+        let mut pair_verify = PairVerify::new(pairings.clone());
+        let discovery = DiscoveryState {
+            advertiser: Arc::new(NullAdvertiser),
+            record: Mutex::new(bridge.service_record.clone()),
+        };
         let mut subscriptions = HashSet::new();
         let response = dispatch_request(
             Request {
@@ -885,12 +1402,15 @@ mod tests {
                 connection_close: false,
             },
             &mut session,
+            (&mut pair_setup, &mut pair_verify),
             &bridge,
             &pairings,
+            &discovery,
             &mut subscriptions,
-        );
-        assert_eq!(response.status, 200);
-        let body: Value = serde_json::from_slice(&response.body).unwrap();
+        )
+        .await;
+        assert_eq!(response.response.status, 200);
+        let body: Value = serde_json::from_slice(&response.response.body).unwrap();
         assert_eq!(body["accessories"].as_array().unwrap().len(), 2);
 
         let response = dispatch_request(
@@ -901,11 +1421,95 @@ mod tests {
                 connection_close: false,
             },
             &mut session,
+            (&mut pair_setup, &mut pair_verify),
             &bridge,
             &pairings,
+            &discovery,
             &mut subscriptions,
-        );
-        assert_eq!(response.status, 204);
+        )
+        .await;
+        assert_eq!(response.response.status, 204);
         assert!(subscriptions.contains(&(2, 8)));
     }
+
+    #[tokio::test]
+    async fn pairing_management_rechecks_admin_and_enforces_last_admin_invariant() {
+        let bridge = bridge();
+        let directory = tempfile::tempdir().unwrap();
+        let pairings = Arc::new(
+            PairingStore::create(
+                directory.path().join("pairings.json"),
+                SetupCode::parse("518-26-003").unwrap(),
+                Some("AA:BB:CC:DD:EE:FF".into()),
+            )
+            .unwrap(),
+        );
+        let admin_key = SigningKey::from_bytes(&[8; 32]);
+        pairings
+            .add_initial(ControllerPairing {
+                controller_id: "test-controller".into(),
+                public_key: admin_key.verifying_key().to_bytes(),
+                admin: true,
+            })
+            .unwrap();
+        let mut session = Session::authenticated_for_test(true);
+        let mut pair_setup = PairSetup::new(pairings.clone());
+        let mut pair_verify = PairVerify::new(pairings.clone());
+        let discovery = DiscoveryState {
+            advertiser: Arc::new(NullAdvertiser),
+            record: Mutex::new(bridge.service_record.clone()),
+        };
+        let mut subscriptions = HashSet::new();
+        let member_key = SigningKey::from_bytes(&[9; 32]).verifying_key().to_bytes();
+        let add = encode_items([
+            (TLV_STATE, [1].as_slice()),
+            (TLV_METHOD, [3].as_slice()),
+            (TLV_IDENTIFIER, b"member".as_slice()),
+            (TLV_PUBLIC_KEY, member_key.as_slice()),
+            (TLV_PERMISSIONS, [0].as_slice()),
+        ]);
+        let result = dispatch_request(
+            Request {
+                method: "POST".into(),
+                target: "/pairings".into(),
+                body: add,
+                connection_close: false,
+            },
+            &mut session,
+            (&mut pair_setup, &mut pair_verify),
+            &bridge,
+            &pairings,
+            &discovery,
+            &mut subscriptions,
+        )
+        .await;
+        assert_eq!(
+            Tlv8::parse(&result.response.body).unwrap().byte(TLV_STATE),
+            Some(2)
+        );
+        assert!(pairings.get("member").unwrap().is_some());
+
+        let remove = encode_items([
+            (TLV_STATE, [1].as_slice()),
+            (TLV_METHOD, [4].as_slice()),
+            (TLV_IDENTIFIER, b"test-controller".as_slice()),
+        ]);
+        let result = dispatch_request(
+            Request {
+                method: "POST".into(),
+                target: "/pairings".into(),
+                body: remove,
+                connection_close: false,
+            },
+            &mut session,
+            (&mut pair_setup, &mut pair_verify),
+            &bridge,
+            &pairings,
+            &discovery,
+            &mut subscriptions,
+        )
+        .await;
+        assert!(result.close_after_response);
+        assert!(pairings.list().unwrap().is_empty());
+    }
 }
diff --git a/v2/crates/homecore-hap/src/session.rs b/v2/crates/homecore-hap/src/session.rs
index 4433d842..d8dfd8cf 100644
--- a/v2/crates/homecore-hap/src/session.rs
+++ b/v2/crates/homecore-hap/src/session.rs
@@ -1,15 +1,8 @@
 //! Per-connection HAP authentication state.
-//!
-//! The transition to [`SessionState::Authenticated`] requires an Ed25519
-//! signature from a persisted controller. The caller is responsible for
-//! supplying the exact Pair-Verify transcript once X25519/HKDF/ChaCha20-
-//! Poly1305 transport is implemented; this crate never substitutes a bearer
-//! token or plaintext shortcut.
-
-use ed25519_dalek::{Signature, Verifier, VerifyingKey};
+#![cfg_attr(not(feature = "hap-server"), allow(dead_code))]
 
+use crate::crypto::SessionKeys;
 use crate::error::HapError;
-use crate::pairing::PairingStore;
 
 /// Authentication phase of one TCP connection.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -32,17 +25,15 @@ impl SessionState {
         }
     }
 
-    /// Whether accessory, characteristic, event, and pairing-management
-    /// endpoints may be processed.
     pub fn is_authenticated(&self) -> bool {
         matches!(self, Self::Authenticated { .. })
     }
 }
 
 /// Fail-closed state machine for one HAP connection.
-#[derive(Debug, Clone)]
 pub struct Session {
     state: SessionState,
+    pending_keys: Option<SessionKeys>,
 }
 
 impl Default for Session {
@@ -55,6 +46,7 @@ impl Session {
     pub fn new() -> Self {
         Self {
             state: SessionState::Connected,
+            pending_keys: None,
         }
     }
 
@@ -62,12 +54,7 @@ impl Session {
         &self.state
     }
 
-    pub fn begin_pair_setup(&mut self, already_paired: bool) -> Result<(), HapError> {
-        if already_paired {
-            return Err(HapError::Protocol(
-                "Pair-Setup is unavailable after a controller is paired".into(),
-            ));
-        }
+    pub fn begin_pair_setup(&mut self) -> Result<(), HapError> {
         self.transition(SessionState::PairSetup)
     }
 
@@ -75,17 +62,11 @@ impl Session {
         self.transition(SessionState::PairVerify)
     }
 
-    /// Authenticate a completed Pair-Verify transcript with the controller's
-    /// persisted Ed25519 long-term public key.
-    ///
-    /// This method is intentionally not called by the current network server:
-    /// the encrypted Pair-Verify transcript is not implemented yet.
-    pub fn authenticate_pair_verify(
+    pub(crate) fn authenticate(
         &mut self,
-        controller_id: &str,
-        signed_transcript: &[u8],
-        signature: &[u8; 64],
-        pairings: &PairingStore,
+        controller_id: String,
+        admin: bool,
+        keys: SessionKeys,
     ) -> Result<(), HapError> {
         if !matches!(self.state, SessionState::PairVerify) {
             return Err(HapError::InvalidSessionTransition {
@@ -93,25 +74,23 @@ impl Session {
                 to: "authenticated",
             });
         }
-        let pairing = pairings
-            .get(controller_id)?
-            .ok_or_else(|| HapError::PairingNotFound(controller_id.to_owned()))?;
-        let key = VerifyingKey::from_bytes(&pairing.public_key)
-            .map_err(|_| HapError::InvalidPairingRecord("invalid Ed25519 public key".into()))?;
-        let signature = Signature::from_bytes(signature);
-        key.verify(signed_transcript, &signature)
-            .map_err(|_| HapError::Protocol("Pair-Verify controller signature rejected".into()))?;
         self.state = SessionState::Authenticated {
-            controller_id: pairing.controller_id,
-            admin: pairing.admin,
+            controller_id,
+            admin,
         };
+        self.pending_keys = Some(keys);
         Ok(())
     }
 
+    pub(crate) fn take_session_keys(&mut self) -> Option<SessionKeys> {
+        self.pending_keys.take()
+    }
+
     pub fn reset_pairing(&mut self) -> Result<(), HapError> {
         match self.state {
             SessionState::PairSetup | SessionState::PairVerify => {
                 self.state = SessionState::Connected;
+                self.pending_keys = None;
                 Ok(())
             }
             _ => Err(HapError::InvalidSessionTransition {
@@ -122,9 +101,17 @@ impl Session {
     }
 
     pub fn close(&mut self) {
+        self.pending_keys = None;
         self.state = SessionState::Closing;
     }
 
+    pub(crate) fn controller_id(&self) -> Option<&str> {
+        match &self.state {
+            SessionState::Authenticated { controller_id, .. } => Some(controller_id),
+            _ => None,
+        }
+    }
+
     #[cfg(all(test, feature = "hap-server"))]
     pub(crate) fn authenticated_for_test(admin: bool) -> Self {
         Self {
@@ -132,6 +119,7 @@ impl Session {
                 controller_id: "test-controller".into(),
                 admin,
             },
+            pending_keys: None,
         }
     }
 
@@ -151,60 +139,31 @@ impl Session {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::pairing::ControllerPairing;
-    use ed25519_dalek::{Signer, SigningKey};
 
     #[test]
-    fn authenticated_transition_requires_persisted_valid_signature() {
-        let directory = tempfile::tempdir().unwrap();
-        let store = PairingStore::open(directory.path().join("pairings.json")).unwrap();
-        let signing_key = SigningKey::from_bytes(&[42; 32]);
-        store
-            .add(ControllerPairing {
-                controller_id: "controller".into(),
-                public_key: signing_key.verifying_key().to_bytes(),
-                admin: true,
-            })
-            .unwrap();
-
-        let transcript = b"pair-verify transcript supplied by protocol implementation";
-        let signature = signing_key.sign(transcript).to_bytes();
+    fn authentication_requires_pair_verify_and_yields_keys_once() {
         let mut session = Session::new();
+        let keys = SessionKeys::derive(&[7; 32]).unwrap();
+        assert!(session
+            .authenticate("controller".into(), true, keys)
+            .is_err());
         session.begin_pair_verify().unwrap();
         session
-            .authenticate_pair_verify("controller", transcript, &signature, &store)
+            .authenticate(
+                "controller".into(),
+                true,
+                SessionKeys::derive(&[7; 32]).unwrap(),
+            )
             .unwrap();
         assert!(session.state().is_authenticated());
-    }
-
-    #[test]
-    fn bad_signature_and_skipped_verify_fail_closed() {
-        let directory = tempfile::tempdir().unwrap();
-        let store = PairingStore::open(directory.path().join("pairings.json")).unwrap();
-        let signing_key = SigningKey::from_bytes(&[9; 32]);
-        store
-            .add(ControllerPairing {
-                controller_id: "controller".into(),
-                public_key: signing_key.verifying_key().to_bytes(),
-                admin: true,
-            })
-            .unwrap();
-
-        let mut session = Session::new();
-        assert!(session
-            .authenticate_pair_verify("controller", b"x", &[0; 64], &store)
-            .is_err());
-        session.begin_pair_verify().unwrap();
-        assert!(session
-            .authenticate_pair_verify("controller", b"x", &[0; 64], &store)
-            .is_err());
-        assert!(!session.state().is_authenticated());
+        assert!(session.take_session_keys().is_some());
+        assert!(session.take_session_keys().is_none());
     }
 
     #[test]
     fn pairing_phases_cannot_overlap() {
         let mut session = Session::new();
-        session.begin_pair_setup(false).unwrap();
+        session.begin_pair_setup().unwrap();
         assert!(session.begin_pair_verify().is_err());
         session.reset_pairing().unwrap();
         session.begin_pair_verify().unwrap();

From e7c598e64c837d865ff8827ddaf89d5d417ebd1f Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 15:08:52 -0400
Subject: [PATCH 14/16] fix(homecore-server): provision stable HAP identity
 securely

---
 v2/crates/homecore-server/src/hap.rs  | 20 +++++++++++++++++++-
 v2/crates/homecore-server/src/main.rs |  8 +++++++-
 v2/docs/homecore-capabilities.md      | 11 ++++++-----
 3 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/v2/crates/homecore-server/src/hap.rs b/v2/crates/homecore-server/src/hap.rs
index 61df950e..9da6217c 100644
--- a/v2/crates/homecore-server/src/hap.rs
+++ b/v2/crates/homecore-server/src/hap.rs
@@ -11,6 +11,7 @@ use homecore::HomeCore;
 pub(crate) struct HapRuntimeConfig {
     pub bind_addr: Option<SocketAddr>,
     pub device_id: Option<String>,
+    pub setup_code: Option<String>,
     pub advertise_addr: Option<IpAddr>,
     pub hostname: String,
     pub instance_name: String,
@@ -84,7 +85,24 @@ pub(crate) async fn start(hc: &HomeCore, config: HapRuntimeConfig) -> Result<Hap
             config.hostname.clone(),
             advertise_addr,
         )?);
-        let pairings = Arc::new(PairingStore::open(&config.pairing_store)?);
+        let pairings = if config.pairing_store.exists() {
+            if config.setup_code.is_some() {
+                tracing::warn!(
+                    "ignoring --hap-setup-code because the pairing store already exists"
+                );
+            }
+            PairingStore::open(&config.pairing_store)?
+        } else {
+            let setup_code = config.setup_code.as_deref().ok_or_else(|| {
+                anyhow::anyhow!("--hap-setup-code is required when creating a HAP pairing store")
+            })?;
+            PairingStore::create(
+                &config.pairing_store,
+                homecore_hap::SetupCode::parse(setup_code)?,
+                Some(device_id.to_owned()),
+            )?
+        };
+        let pairings = Arc::new(pairings);
         let record =
             HapServiceRecord::bridge(config.instance_name.clone(), bind_addr.port(), device_id);
         let bridge = HapBridge::new(record);
diff --git a/v2/crates/homecore-server/src/main.rs b/v2/crates/homecore-server/src/main.rs
index d6072aab..cca78792 100644
--- a/v2/crates/homecore-server/src/main.rs
+++ b/v2/crates/homecore-server/src/main.rs
@@ -149,6 +149,11 @@ struct Cli {
     #[arg(long, env = "HOMECORE_HAP_DEVICE_ID")]
     hap_device_id: Option<String>,
 
+    /// HAP setup code in `XXX-XX-XXX` form. Required only when creating a
+    /// pairing store for the first time and never persisted in plaintext.
+    #[arg(long, env = "HOMECORE_HAP_SETUP_CODE", hide_env_values = true)]
+    hap_setup_code: Option<String>,
+
     /// LAN address published in the HAP mDNS record. Required when HAP is enabled.
     #[arg(long, env = "HOMECORE_HAP_ADVERTISE_ADDR")]
     hap_advertise_addr: Option<std::net::IpAddr>,
@@ -177,7 +182,7 @@ struct Cli {
 #[tokio::main]
 async fn main() -> Result<()> {
     init_tracing();
-    let cli = Cli::parse();
+    let mut cli = Cli::parse();
     let has_tokens = std::env::var("HOMECORE_TOKENS")
         .map(|value| !value.trim().is_empty())
         .unwrap_or(false);
@@ -325,6 +330,7 @@ async fn main() -> Result<()> {
         hap::HapRuntimeConfig {
             bind_addr: cli.hap_bind,
             device_id: cli.hap_device_id.clone(),
+            setup_code: cli.hap_setup_code.take(),
             advertise_addr: cli.hap_advertise_addr,
             hostname: cli.hap_hostname.clone(),
             instance_name: cli.hap_instance_name.clone(),
diff --git a/v2/docs/homecore-capabilities.md b/v2/docs/homecore-capabilities.md
index 84abde27..cd19d524 100644
--- a/v2/docs/homecore-capabilities.md
+++ b/v2/docs/homecore-capabilities.md
@@ -68,11 +68,12 @@ registry currently returns a valid empty list.
   native plugins must be linked into the binary and registered in code.
 - HAP is disabled by default. Enabling it requires an explicit bind address,
   stable six-octet device identifier, advertised LAN address, hostname, and
-  durable pairing-store path.
-- The HAP listener fails closed for cryptographic phases that are unavailable
-  in the selected build. Do not claim Apple Home interoperability unless the
-  Pair-Setup, Pair-Verify, and encrypted transport conformance tests for that
-  build pass.
+  durable pairing-store path. First provisioning also requires an explicit
+  non-trivial `XXX-XX-XXX` setup code; only its SRP verifier is persisted.
+- The HAP listener implements SRP-6a Pair-Setup, X25519/Ed25519 Pair-Verify,
+  ChaCha20-Poly1305 HAP IP records, controller administration, and paired-state
+  mDNS updates. Internal protocol/tamper/replay tests pass; external Apple Home
+  certification is not claimed.
 - STT and TTS are provider contracts; a deployment must supply real providers.
   The built-in disabled providers return typed errors rather than fabricated
   speech results.

From 546081e628b020a7bfa11493b1048fa9d6c32b8a Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 15:11:03 -0400
Subject: [PATCH 15/16] docs(homecore): record platform runtime completion

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5946fea..f73003f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+
+- **HOMECORE platform runtime completion — secure native/Wasmtime plugins, authenticated HAP IP, expanded Home Assistant APIs, durable restoration/migration, and voice protocols.** `homecore-server` now owns deterministic compiled-in native plugin registration plus explicitly configured, path-bounded, Ed25519 publisher-verified Wasm packages executed through Wasmtime with setup/state-change/teardown lifecycle; arbitrary native dynamic libraries remain intentionally unsupported. The optional HAP server implements persisted accessory identity and controller records, SRP-6a Pair-Setup M1–M6, X25519/Ed25519 Pair-Verify M1–M4, HKDF-SHA512/ChaCha20-Poly1305 record framing, authenticated/admin endpoint gates, replay/tamper closure, live entity synchronization, and paired-state `_hap._tcp` mDNS updates (45 focused tests; external Apple certification is not claimed). Startup restores device/entity registries and deterministic latest recorder states before plugins, and migration now atomically preserves forward-compatible device/config-entry fields. The HA-compatible surface adds events, templates, config checks, components, registries, history/logbook with SQL-enforced global response bounds, calendar/camera provider routes, and modern WebSocket negotiation while retaining a machine-readable limitations matrix for integration-specific behavior. Assist adds bounded PCM16, async STT/TTS contracts, an end-to-end speech pipeline, and an authenticated satellite session protocol; real deployments still provide the speech engines.
 - **`ruview-unified` increment 3 — Gaussian update-loop completion, separable delay-Doppler, and property-tested boundary hardening.** (1) `GaussianMap::merge_overlapping` (ADR-275 step 5: mutual-Mahalanobis + semantic-compatibility dedup catching drift the insert-time gate misses) and lifetime-aware decay (`τ_eff = τ·(1+ln(1+lifetime/τ))` — confirmed structures outlive transients at equal nominal τ). (2) `delay_doppler_map` reimplemented separably (`O(B²S+S²B)`), proven equivalent to the direct reference to <1e-10 and **measured 8.3× faster** (520 µs vs 4.34 ms at 56×8). (3) `tests/security_boundaries.rs` — 8 `proptest` properties over the boundary surfaces (arbitrary values incl. NaN/±inf via `f64::from_bits`) that found and fixed three input-controlled defects: a BLE-CS phase-unwrap infinite loop on non-finite phases and an ~1e299-iteration loop on finite-huge phases (now O(1) modular unwrap + plausibility bound), and a subnormal Gaussian scale overflowing `1/σ²` to NaN density (now physical σ/occupancy bounds). (4) New criterion benches for all increment-2 hot paths (`to_canonical` 38 µs, `ble_cs_range` 481 ns, AoI planner 647 ns/200 regions, coherent fusion 1.5 µs/32 members, factorized pose 521 ns). ruview-unified now 98 tests (87 lib + 3 acceptance + 8 security), 0 failed, clippy-clean.
 - **`ruview-unified` increment 2 — native frame contract + programmable perception (ADR-279..282).** (1) `RfFrameV2` becomes the authoritative RF record: native complex IQ with explicit validity masks, declared `PhaseState`, TX/RX poses + antenna geometry in one building frame, calibration/quality state, and a provenance rule enforced at construction — `Synthetic ⇒ L0Simulation` and `Measured ⇒ ≥ L1CapturedReplay` can never alias (the public L0–L5 evidence ladder is now a type); the 56-bin canonical tensor is demoted to a derived compatibility view (`to_canonical`, mask-aware gap-filling through the same normalization path as every adapter; native samples proven byte-untouched). (2) Active sensing control plane (`control.rs`): ETSI-ISAC-vocabulary `SensingTask` admission (raw export always refused; identity requires consent), `SensingAction`/`InformationGoal`, an age-of-information `ActiveSensingPlanner` (priority = uncertainty × change rate × criticality ÷ cost; **measured 95% sensing-traffic reduction** vs uniform refresh on a 20-region scenario), fail-closed `CoherentSensorGroup` fusion gates (time/phase/geometry bounds; five denial paths tested), policy-authorized RIS/movable-antenna actuation receipts, and purpose-scoped `TaskSufficientRepresentation` leakage validation. (3) New modality surfaces: BLE Channel Sounding adapter + `ble_cs_range` treating phase-slope and RTT as **separate cross-validated evidence** (exact distance recovery on synthetic tones; relay-style divergence flagged, never averaged), delay-Doppler-native `FieldAxis` + `delay_doppler_map` (unit-peak tone test), IEEE P3162 synthetic-aperture import profile. (4) RePos-factorized pose head (relative skeleton on the content representation, root on the geometry-conditioned one, calibrated per-joint uncertainties): held-out-room MPJPE 0.0003 m vs 0.2534 m for the monolithic baseline in the room-shortcut leakage experiment; ≤2% structured-adapter budget (740 params). (5) Age gate input now `log(1+age_ms)` per the age-aware-CSI recipe (gradient check re-proven); Gaussian primitives gained `first_seen_ns`/`doppler_variance`/bounded `source_receipts` lineage; `PartitionKey` gained a `session` dimension and `SplitManifest` certifies disjointness across all seven dimensions. 87 tests, 0 failed; crate clippy-clean. Docker images unaffected (no shipped binary consumes the crate yet); Python proof re-verified PASS.
 - **`ruview-unified` — unified RF spatial world model, P1 (ADR-273..278).** New v2 workspace leaf crate implementing the five-pillar architecture: (1) canonical `RfTensor` (`links × 56 bins × 8 snapshots`, complex, validated at the boundary) plus a fail-closed hardware adapter registry with reference adapters for 802.11 CSI (consumes `wifi-densepose-core::CsiFrame`), FMCW radar cubes (fast-time DFT), UWB CIR, and 5G SRS (comb de-interleave); (2) a universal RF foundation encoder — window-median + CFO-aligned tokenizer, masked-reconstruction pretraining with a hand-derived backward pass verified against central finite differences (174 params sampled, max rel err 1.31e-5), the ADR-273 fusion contract `z = Enc(CSI) ⊙ σ(AgeEnc) + GeomEnc(pose)`, and ≤1% task adapters (presence 129 / activity 268 / localization 387 / anomaly 2 vs a 40,856-param backbone); (3) an RF-aware Gaussian spatial memory — anisotropic primitives with per-band×angle reflectivity, confidence-weighted fusion, exponential decay, spatial-hash + semantic queries, closed-form (erf) Beer–Lambert channel-gain queries that degrade to exact Friis on an empty map, inverse gain updates that learn an unseen 6 dB obstruction to <0.5 dB in 20 link observations, and a JITOMA-style task-gated scene graph; (4) a physics-guided synthetic RF world generator — Allen–Berkley image method (order ≤2), complex-permittivity Fresnel materials, bistatic person scattering with *emergent* Doppler (proven against the analytic phase rate), seeded ChaCha20 domain randomization of physics + hardware nuisances (gain/CFO/phase noise/packet loss/interference); (5) an edge sensing control plane — 802.11bf/ETSI-ISAC-aligned purposes and zones, fail-closed authorization, a double-gated identity purpose, retention bounds, and a `BoundedEvent`-only trust boundary that makes raw RF export unrepresentable. Anti-leakage evaluation (`StrictSplit` by room/day/person/chipset/firmware/layout with an independent disjointness verifier, ECE, selective risk, degradation) plus an end-to-end acceptance pipeline: presence F1 1.00 on held-out rooms *and* held-out chipset, degradation 0.0, ECE 0.012, p95 tokenize+encode 2.0 ms debug / 105 µs release — **all SYNTHETIC** (honest labeling propagates from `RfModality::Synthetic` through `Provenance.synthetic`). Criterion benches with an optimization pass: segment-corridor candidate search took `channel_gain` from 139 µs → 27 µs (O(1) in map size; hash/linear crossover at ~4k Gaussians reported honestly), `observe_link` 305 µs → 74 µs, precomputed DFT twiddles 4.9×. 66 unit + 3 acceptance tests, 0 failed.

From 5bf820700cf3706e666e87b3a9995252fdcc8638 Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Mon, 27 Jul 2026 15:23:33 -0400
Subject: [PATCH 16/16] fix(homecore-plugins): use patched Wasmtime runtime

---
 v2/Cargo.lock                             | 340 ++++++++--------------
 v2/crates/homecore-plugins/Cargo.toml     |  16 +-
 v2/crates/homecore-plugins/src/lib.rs     |  13 +-
 v2/crates/homecore-plugins/src/runtime.rs |   5 +-
 4 files changed, 136 insertions(+), 238 deletions(-)

diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index 9ff7bed5..cf3e9851 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -179,7 +179,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -190,14 +190,14 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "approx"
@@ -502,15 +502,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "bitmaps"
-version = "2.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "031043d04099746d8db04daf1fa424b2bc8bd69d92b25962dcde24da39ab64a2"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "blake3"
 version = "1.8.5"
@@ -877,7 +868,7 @@ dependencies = [
  "find-msvc-tools",
  "jobserver",
  "libc",
- "shlex 1.3.0",
+ "shlex",
 ]
 
 [[package]]
@@ -1334,36 +1325,36 @@ dependencies = [
 
 [[package]]
 name = "cranelift-assembler-x64"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6abf69c884fde2d9d4cc232a585fb18f16af3ae04c634315c84ebe158ded92d"
+checksum = "3cd990d8a6304475bbad64534a0d418f5572f44d5f011437e6b9f1ee7d5c2570"
 dependencies = [
  "cranelift-assembler-x64-meta",
 ]
 
 [[package]]
 name = "cranelift-assembler-x64-meta"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "263d31fcdf83a10267e8c38b53bc8f7688dfbc331267fd8fdf5b22e0dc47a55b"
+checksum = "ccabe4636007296721080e02d7dab46d4319638ec4e3f6f7402fcb46dc5122c6"
 dependencies = [
  "cranelift-srcgen",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d459d5377c01c4472b71029caa2df41afaf47711676aa9b12d7414f15104637b"
+checksum = "da7ed173c870c0aea202a9830880156905a028a88df076e35ce383a8acbf90a7"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8283088d5823ba7856ab8d531b7c3654b24984748f9fd99dcf3210701fd1d065"
+checksum = "800cc586df98b12c502e76707c96565e40629a5322eaa15aaa34ba05f5721e31"
 dependencies = [
  "serde",
  "serde_derive",
@@ -1371,9 +1362,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d3138316d8dd341d725d6ab1598750545c76ad32892837fde558edd68a01b43"
+checksum = "ae93f863f9094ae34d2567f9edb0ae2c41d35228b286598354dd78b198868ebd"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -1398,9 +1389,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "505cead19304a8dc8689e31b29038775c3f73f9d5ea7a5e33864437a1f46c6b6"
+checksum = "38c505162bcf77dcb859905b3eac56a1917fc3cf326424fb06e7732031e3a8ae"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
@@ -1411,24 +1402,24 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce62ba94f570644ce7de6ed05bd39ca28936665dec10a2a1f6f2c531d6add45c"
+checksum = "e3b786958bcb79bdb5fbae095af58f0c2da7d7895c475c991f6a6bb5a9c7e6d9"
 
 [[package]]
 name = "cranelift-control"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db6cfe339689c3926412a7060ab00ef3b2b43d936b537e7a3f696121be9d0eaa"
+checksum = "2faf9a5009bce7f725ce2af7a08c4883ebac6af933e7e0aa7d84f976f4e6deb5"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625518090e912bdfe3c41464bf97ae421f6044d4ca0f5c3267dcacdb352b033d"
+checksum = "017271194ba5e101d626560d0d6767efd341468d1ba0f4d015f19fe64020b65b"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -1437,9 +1428,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17f652d40ddf3afb55be64d8979d312b52b384a8cebbcde1dd1c2e32ebcd4466"
+checksum = "f80847f0929967f0cec82f9e0543b3901e0f0063690405891f22107b5a130fd8"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -1449,15 +1440,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f512767e83015f4baf6e732cabca93cea82907e3ab237f826ef64f7ece75eb6"
+checksum = "75904abbc0e7b46d20f7a49c8042c8a4481c0db4253b99889c723c566295d506"
 
 [[package]]
 name = "cranelift-native"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb1ca6e4dca568ff988d367e4707be2362cee9782265b0a501eaf467ffd550a8"
+checksum = "6e0135923540574362e16f01bf40000664263840991039ff3041ba717de6cf3a"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -1466,9 +1457,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-srcgen"
-version = "0.127.4"
+version = "0.123.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97400ad8fbd3a434092fc0b486fa7784150b53187941d818b1087f3ac0a547f0"
+checksum = "93fb12f76c482e034f6ebefa843c914e74112f088215d8d36d33a649f9fab99b"
 
 [[package]]
 name = "crc"
@@ -1576,9 +1567,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1719,12 +1710,6 @@ dependencies = [
  "cmov",
 ]
 
-[[package]]
-name = "cty"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b365fabc795046672053e29c954733ec3b05e4be654ab130fe8f1f94d7051f35"
-
 [[package]]
 name = "cudarc"
 version = "0.17.8"
@@ -1960,7 +1945,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2271,7 +2256,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2627,15 +2612,14 @@ dependencies = [
 
 [[package]]
 name = "fxprof-processed-profile"
-version = "0.8.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25234f20a3ec0a962a61770cfe39ecf03cb529a6e474ad8cff025ed497eda557"
+checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd"
 dependencies = [
  "bitflags 2.11.0",
  "debugid",
- "rustc-hash",
+ "fxhash",
  "serde",
- "serde_derive",
  "serde_json",
 ]
 
@@ -3771,7 +3755,6 @@ dependencies = [
  "thiserror 1.0.69",
  "tokio",
  "uuid",
- "wasm3",
  "wasmtime",
  "wat",
 ]
@@ -4192,20 +4175,6 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "im-rc"
-version = "15.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af1955a75fa080c677d3972822ec4bad316169ab1cfc6c257a942c2265dbe5fe"
-dependencies = [
- "bitmaps",
- "rand_core 0.6.4",
- "rand_xoshiro",
- "sized-chunks",
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -4312,7 +4281,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4892,9 +4861,9 @@ dependencies = [
 
 [[package]]
 name = "memmap2"
-version = "0.9.10"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
  "stable_deref_trait",
@@ -5349,7 +5318,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5829,7 +5798,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -6555,9 +6524,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5de307c194cf6310d486dd5595ffc329c53b4acafd54e214752c1eb2e68be3a9"
+checksum = "558181096e0df4984f45cfc3a7087052df4a61c36089b135a08ceca9cbd352fb"
 dependencies = [
  "cranelift-bitset",
  "log",
@@ -6567,9 +6536,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-macros"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99dca2747e910d10bafe911e172a1b35860268421c3ee5ddb7e16c35e0288b4a"
+checksum = "b5d52e2f14e168d75cdabe9bd5fb1ff18a1b119dc6699684aee895dbc3524da9"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6684,9 +6653,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.13"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
  "bytes",
  "fastbloom",
@@ -6888,15 +6857,6 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
-[[package]]
-name = "rand_xoshiro"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f97cdb2a36ed4183de61b2f824cc45c9f1037f28afe0a322e9fff4c108b5aaa"
-dependencies = [
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "raw-cpuid"
 version = "10.7.0"
@@ -7036,9 +6996,9 @@ dependencies = [
 
 [[package]]
 name = "regalloc2"
-version = "0.13.5"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08effbc1fa53aaebff69521a5c05640523fab037b34a4a2c109506bc938246fa"
+checksum = "5216b1837de2149f8bc8e6d5f88a9326b63b8c836ed58ce4a0a29ec736a59734"
 dependencies = [
  "allocator-api2",
  "bumpalo",
@@ -7481,7 +7441,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -7596,7 +7556,7 @@ dependencies = [
  "security-framework 3.7.0",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -8410,12 +8370,6 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
-[[package]]
-name = "shlex"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fdf1b9db47230893d76faad238fd6097fd6d6a9245cd7a4d90dbd639536bbd2"
-
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -8521,16 +8475,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
 
-[[package]]
-name = "sized-chunks"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16d69225bde7a69b235da73377861095455d298f2b970996eec25ddbb42b3d1e"
-dependencies = [
- "bitmaps",
- "typenum",
-]
-
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -9506,7 +9450,7 @@ dependencies = [
  "getrandom 0.4.1",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -10675,35 +10619,14 @@ version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cfe29135b180b72b04c74aa97b2b4a2ef275161eff9a6c7955ea9eaedc7e1d4e"
 
-[[package]]
-name = "wasm-compose"
-version = "0.243.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af801b6f36459023eaec63fdbaedad2fd5a4ab7dc74ecc110a8b5d375c5775e4"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "im-rc",
- "indexmap 2.13.0",
- "log",
- "petgraph",
- "serde",
- "serde_derive",
- "serde_yaml",
- "smallvec",
- "wasm-encoder 0.243.0",
- "wasmparser 0.243.0",
- "wat",
-]
-
 [[package]]
 name = "wasm-encoder"
-version = "0.243.0"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c55db9c896d70bd9fa535ce83cd4e1f2ec3726b0edd2142079f594fc3be1cb35"
+checksum = "724fccfd4f3c24b7e589d333fc0429c68042897a7e8a5f8694f31792471841e7"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.243.0",
+ "wasmparser 0.236.1",
 ]
 
 [[package]]
@@ -10762,32 +10685,11 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "wasm3"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7dde97449e99be474a432bbb0b1ab40b8f7ce3e97aa7ac640e9ecd018bbf88"
-dependencies = [
- "cty",
- "wasm3-sys",
-]
-
-[[package]]
-name = "wasm3-sys"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a4e5d10bf1ffe7753275d4bbae3dc135dd2d2decd90e615accf9fef8bc52bab"
-dependencies = [
- "cc",
- "cty",
- "shlex 0.1.1",
-]
-
 [[package]]
 name = "wasmparser"
-version = "0.243.0"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6d8db401b0528ec316dfbe579e6ab4152d61739cfe076706d2009127970159d"
+checksum = "a9b1e81f3eb254cf7404a82cee6926a4a3ccc5aad80cc3d43608a070c67aa1d7"
 dependencies = [
  "bitflags 2.11.0",
  "hashbrown 0.15.5",
@@ -10821,20 +10723,20 @@ dependencies = [
 
 [[package]]
 name = "wasmprinter"
-version = "0.243.0"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb2b6035559e146114c29a909a3232928ee488d6507a1504d8934e8607b36d7b"
+checksum = "2df225df06a6df15b46e3f73ca066ff92c2e023670969f7d50ce7d5e695abbb1"
 dependencies = [
  "anyhow",
  "termcolor",
- "wasmparser 0.243.0",
+ "wasmparser 0.236.1",
 ]
 
 [[package]]
 name = "wasmtime"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0702b64d4c3fe43ae4ce229e06af06a27783e48c519e68586d180717cdd24314"
+checksum = "4b4442dc12aa2473def8334f0e0f2b489be52c52507c938bbdc8be69ded4ded6"
 dependencies = [
  "addr2line",
  "anyhow",
@@ -10844,7 +10746,6 @@ dependencies = [
  "cc",
  "cfg-if",
  "encoding_rs",
- "futures",
  "fxprof-processed-profile",
  "gimli",
  "hashbrown 0.15.5",
@@ -10866,11 +10767,10 @@ dependencies = [
  "serde_json",
  "smallvec",
  "target-lexicon 0.13.5",
- "tempfile",
- "wasm-compose",
- "wasm-encoder 0.243.0",
- "wasmparser 0.243.0",
+ "wasm-encoder 0.236.1",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
+ "wasmtime-internal-asm-macros",
  "wasmtime-internal-cache",
  "wasmtime-internal-component-macro",
  "wasmtime-internal-component-util",
@@ -10884,14 +10784,14 @@ dependencies = [
  "wasmtime-internal-versioned-export-macros",
  "wasmtime-internal-winch",
  "wat",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "wasmtime-environ"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ffeb777a21965a85e4b1ce7b308c63ba130df91912096b49b95523bf3bdd2c7"
+checksum = "5d881c3d6205898a226cc487b117f23b9ed1c7da39952d65bd5eeb6745b3789c"
 dependencies = [
  "anyhow",
  "cpp_demangle",
@@ -10908,17 +10808,26 @@ dependencies = [
  "serde_derive",
  "smallvec",
  "target-lexicon 0.13.5",
- "wasm-encoder 0.243.0",
- "wasmparser 0.243.0",
+ "wasm-encoder 0.236.1",
+ "wasmparser 0.236.1",
  "wasmprinter",
  "wasmtime-internal-component-util",
 ]
 
 [[package]]
-name = "wasmtime-internal-cache"
-version = "40.0.4"
+name = "wasmtime-internal-asm-macros"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf419cf9b748d443be7aead0fc85c36dcdfdb4bbbd8203b3cf47179d6de4b0dd"
+checksum = "5ab1876bcfa51d6a05dea1c13933f53cbc1e316c783fddebc859f56a736eae07"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "wasmtime-internal-cache"
+version = "36.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2195a1521a5214a71b67ca2ba2d9317ae15917288ea9d8e5836142b921c9d155"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -10929,16 +10838,16 @@ dependencies = [
  "serde",
  "serde_derive",
  "sha2 0.10.9",
- "toml 0.9.12+spec-1.1.0",
- "windows-sys 0.61.2",
+ "toml 0.8.23",
+ "windows-sys 0.60.2",
  "zstd 0.13.3",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "935bb8db1e2829bf26b80ed3daeed6cf9fc804f7002c90a8d17dbd5e93c69e0b"
+checksum = "8ae1407944a0b13a8a77930b5b951aa7134beccecad7efac1ef9f03adb7d1a0f"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -10946,20 +10855,20 @@ dependencies = [
  "syn 2.0.117",
  "wasmtime-internal-component-util",
  "wasmtime-internal-wit-bindgen",
- "wit-parser 0.243.0",
+ "wit-parser 0.236.1",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52625d0c8fe2df1d7dd96d45d37dae8818c183c183a82b2368e3741ee5253859"
+checksum = "646a53678ce6aaf6f097e18ca51f650f2841aea6d2bcd7b61931397b8b8f30db"
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85da1ba5fee01a3ee21c4d0c8052cc9035388639fa091a969b534d4c6f8449d4"
+checksum = "ab3495aa8300e4ca6b53f81a53ce5eff6621fd5ff8378ef9ae552d1479d57371"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -10976,33 +10885,33 @@ dependencies = [
  "smallvec",
  "target-lexicon 0.13.5",
  "thiserror 2.0.18",
- "wasmparser 0.243.0",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
  "wasmtime-internal-math",
- "wasmtime-internal-unwinder",
  "wasmtime-internal-versioned-export-macros",
 ]
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4c7de5a0872764c1ca640886af10a70cf7f8526386906245b43cdb345ece0e6"
+checksum = "29b5e4023a6b167da157338f5f0f505945eb45e78f1cac2d4dcce0922457d7d4"
 dependencies = [
  "anyhow",
  "cc",
  "cfg-if",
  "libc",
  "rustix",
+ "wasmtime-internal-asm-macros",
  "wasmtime-internal-versioned-export-macros",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "160acd973d770d62bef1b2697d7fac83a8fe63ef966215e624382b2a9532bd58"
+checksum = "9da71e2d573e3cc6f753a3b7bff98f425ca060c0e8071cc55c3d867a9edf3ecc"
 dependencies = [
  "cc",
  "object",
@@ -11012,36 +10921,36 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc57f590ba7ea967ea9e8c8560175c6926e5b15d11c29bbde3ad0013a29470eb"
+checksum = "627d8f57909a4f9bb1dbe57a96229a54b89d5995353d0b321f3cb9a1a118977a"
 dependencies = [
  "anyhow",
  "cfg-if",
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "wasmtime-internal-math"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07612904518d47b677e8db67ca47c16d8c8cefb0099020729f886776950cb58b"
+checksum = "45b99315585a8a27125dd9b0150edb115d6f6ff0baae453c21d30822aab77f00"
 dependencies = [
  "libm",
 ]
 
 [[package]]
 name = "wasmtime-internal-slab"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc83ff16531e1e1537e0de2b630af56a0a9e1fab864130c5b7e213da71783a0f"
+checksum = "8eaee97281dd3fe47ec3d46c16fb9fe2dd32f37d0523c2d5c484f11b348734e4"
 
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47371d697244785e4bbb371229f9a2daa8628d1e03368ec895cf658370e1bf38"
+checksum = "d0c005f82c48492b6b44fa19ee5205bd933c4f8baca41e314eca8331dd3c4fd9"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -11052,9 +10961,9 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad3cd4aff8f2e7ec658c7a0424b74ad88a6940505303fb0616323592a1c400a6"
+checksum = "7b73639a9c0c0e33a2ef942ca99b6772b48393be92bebbd0767c607e5b0a68e0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -11063,17 +10972,16 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-winch"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc4d1e6a37b397aa0a16b3b7f3a48f317d73c81ac7801be1fa9a135f30c55421"
+checksum = "392ca021d084c7426616ef77e1284315555f11bcbb34f416d74b0732db622811"
 dependencies = [
  "anyhow",
  "cranelift-codegen",
  "gimli",
- "log",
  "object",
  "target-lexicon 0.13.5",
- "wasmparser 0.243.0",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
  "wasmtime-internal-cranelift",
  "winch-codegen",
@@ -11081,15 +10989,15 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73a5774737acccdc70ff27bbe9e09c45b156bd7792bb83906735a572ce122247"
+checksum = "7fd4703351476262d715b72431e80d10289908e3494050071d6521267f522d97"
 dependencies = [
  "anyhow",
  "bitflags 2.11.0",
  "heck 0.5.0",
  "indexmap 2.13.0",
- "wit-parser 0.243.0",
+ "wit-parser 0.236.1",
 ]
 
 [[package]]
@@ -11737,7 +11645,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -11748,9 +11656,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "40.0.4"
+version = "36.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcca3ffe030cc6fe77f2055c19d850bcb2c2589fa6ddc7a8ebb446f7c2b1e715"
+checksum = "61ec880b20caaa72245944b54cfb22aca111f8c805e12a7542b40d66921e5323"
 dependencies = [
  "anyhow",
  "cranelift-assembler-x64",
@@ -11760,7 +11668,7 @@ dependencies = [
  "smallvec",
  "target-lexicon 0.13.5",
  "thiserror 2.0.18",
- "wasmparser 0.243.0",
+ "wasmparser 0.236.1",
  "wasmtime-environ",
  "wasmtime-internal-cranelift",
  "wasmtime-internal-math",
@@ -12424,9 +12332,9 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.243.0"
+version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df983a8608e513d8997f435bb74207bf0933d0e49ca97aa9d8a6157164b9b7fc"
+checksum = "16e4833a20cd6e85d6abfea0e63a399472d6f88c6262957c17f546879a80ba15"
 dependencies = [
  "anyhow",
  "id-arena",
@@ -12437,7 +12345,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-xid",
- "wasmparser 0.243.0",
+ "wasmparser 0.236.1",
 ]
 
 [[package]]
diff --git a/v2/crates/homecore-plugins/Cargo.toml b/v2/crates/homecore-plugins/Cargo.toml
index e20c940a..579adbbc 100644
--- a/v2/crates/homecore-plugins/Cargo.toml
+++ b/v2/crates/homecore-plugins/Cargo.toml
@@ -5,9 +5,7 @@
 #   - PluginRuntime trait + InProcessRuntime (native Rust, first-party plugins)
 #   - PluginRegistry (load / unload / list)
 #
-# P2 will add the `wasmtime` feature (gated below, default-off) for the real
-# Wasmtime JIT sandbox. wasm3 interpretation mode lands behind `--features wasm3`
-# in P3 for constrained-hardware targets.
+# The `wasmtime` feature gates the audited server-side WebAssembly sandbox.
 
 [package]
 name = "homecore-plugins"
@@ -27,8 +25,6 @@ default = []
 # P2: real Wasmtime JIT sandbox (Cranelift; ~15 MB binary delta on Pi 5).
 # Do not enable in production until the host ABI is frozen (ADR-128 §8 risk).
 wasmtime = ["dep:wasmtime"]
-# P3: wasm3 interpretation mode for constrained hardware (~50 kB).
-wasm3 = ["dep:wasm3"]
 
 [dependencies]
 # HOMECORE state machine — local path (ADR-127).
@@ -60,13 +56,11 @@ hex = "0.4"
 base64 = "0.22"
 
 # Optional Wasmtime runtime (P2, default-off — 30 MB dep).
-# Bumped from 25.0.3 → 42 to remediate RUSTSEC-2026-0095 and RUSTSEC-2026-0096
-# (Cranelift/Winch sandbox-escape CVEs, CVSS 9.0 — iter-11 security sprint HC-03/04).
-# v40 is the newest line compatible with HOMECORE's Rust 1.89 MSRV.
-wasmtime = { version = "40.0.4", optional = true }
+# Upgraded from 25.0.3 to remediate the Cranelift/Winch sandbox advisories;
+# 40.0.4 was subsequently replaced because of RUSTSEC-2026-0114.
+# Patched 36.x retains HOMECORE's Rust 1.89 MSRV.
+wasmtime = { version = "36.0.8", optional = true }
 
-# Optional wasm3 interpretation runtime (P3, default-off).
-wasm3 = { version = "0.3", optional = true }
 
 [dev-dependencies]
 tokio = { version = "1", features = ["sync", "rt", "rt-multi-thread", "time", "macros", "test-util"] }
diff --git a/v2/crates/homecore-plugins/src/lib.rs b/v2/crates/homecore-plugins/src/lib.rs
index a0ec6665..2784eeee 100644
--- a/v2/crates/homecore-plugins/src/lib.rs
+++ b/v2/crates/homecore-plugins/src/lib.rs
@@ -14,14 +14,12 @@
 //! - [`registry`] — `PluginRegistry<R>`: load / unload / list plugins.
 //! - [`error`] — `PluginError` typed error enum.
 //!
-//! ## What's NOT here yet (deferred)
+//! ## Runtime scope
 //!
-//! - `WasmtimeRuntime` (P2, `--features wasmtime`): Cranelift JIT sandbox on
-//!   Pi 5 / x86_64. The runtime-selection question (Wasmtime vs wasm3) is still
-//!   open (ADR-128 §8) and will be resolved in Q2 before P2 begins.
-//! - Host ABI wiring: `hc_state_get`, `hc_state_set`, `hc_event_fire`, etc.
-//!   (P2 — requires ADR-127 state machine API freeze first).
-//! - Config entry lifecycle + hot-load (P3).
+//! - `WasmtimeRuntime` (`--features wasmtime`) provides the Cranelift sandbox.
+//! - Native Rust plugins are compiled into the server; arbitrary native
+//!   dynamic libraries are not loaded.
+//! - The host ABI is deliberately narrow and resource-bounded.
 //!
 //! ## Now enforced (ADR-162)
 //!
@@ -38,7 +36,6 @@
 //! | Feature | Default | Description |
 //! |---------|---------|-------------|
 //! | `wasmtime` | off | Wasmtime Cranelift JIT runtime (P2) |
-//! | `wasm3` | off | wasm3 interpreter runtime for constrained hardware (P3) |
 
 pub mod error;
 pub mod discovery;
diff --git a/v2/crates/homecore-plugins/src/runtime.rs b/v2/crates/homecore-plugins/src/runtime.rs
index ee00a47f..c9b3fc4d 100644
--- a/v2/crates/homecore-plugins/src/runtime.rs
+++ b/v2/crates/homecore-plugins/src/runtime.rs
@@ -1,8 +1,8 @@
 //! `PluginRuntime` trait + `InProcessRuntime` (P1).
 //!
 //! Abstracts over Wasmtime (P2, `--features wasmtime`) and native in-process
-//! Rust plugins (P1, always-on). A third backend, wasm3 (P3), will provide
-//! interpretation mode for constrained hardware.
+//! Rust plugins (P1, always-on). Constrained builds use the compiled-in native
+//! registry rather than an unaudited interpreter backend.
 //!
 //! # Architecture
 //!
@@ -12,7 +12,6 @@
 //!       ▼
 //! PluginRuntime  ◄─── InProcessRuntime  (P1, native Rust, <1 µs call)
 //!                ◄─── WasmtimeRuntime   (P2, Cranelift JIT, ~5 ms cold start)
-//!                ◄─── Wasm3Runtime      (P3, interpreter, ~50 kB, Pi Zero)
 //! ```
 
 use std::sync::Arc;