docs: record Matter/IPv6 findings — stale matter-server mDNS address, SSID cleanup, ER-X ULA infeasibility (W1N-207)

hosts/hass.windy.lan.md

@@ -248,28 +248,59 @@ The `_unrecorded_attributes` mechanism exists in Core 2026.8.1
 by recorder `shared_attrs_bytes_from_event`).
 
 
-### `matrix_e2ee` live tree (E2E Matrix bot, verified 2026-08-18, W1N-180)
+### `matrix_e2ee` live tree (E2E Matrix bot, verified 2026-08-20)
 
-**v0.3.0** (W1N-180/#32: bot-initiated device verification wizard; also
-includes W1N-179/#31 fix `receive_mac_event` cancel-state override):
-source copy from `/home/windy/project/ha-matrix-e2ee` main `216cc99`
-deployed 2026-08-18 via SSH rsync from workstation (upgraded from v0.2.10,
-backup `matrix_e2ee.bak-20260818-v0.2.10`).
+**v0.3.12** (tag `v0.3.12`; feat — Matrix activity events
+`matrix_e2ee_message_received` / `matrix_e2ee_verification_done` + push
+diagnostics; v0.3.9 added Connection health binary sensor, SAS/command
+allowlist split, URL normalization, single-entry enforcement):
+source copy from `/home/windy/project/ha-matrix-e2ee` `ea421ed` (tag
+`v0.3.12`) deployed 2026-08-20 via SSH rsync from workstation (upgraded
+from v0.3.2, backup `matrix_e2ee.bak-20260820-v0.3.2`).
 Custom **`matrix_e2ee`** integration — **Config Flow** (UI). See
 [docs/home-assistant-matrix.md](../docs/home-assistant-matrix.md).
 **Update runbook:** [runbooks/matrix-e2ee-update.md](../runbooks/matrix-e2ee-update.md).
 
+Earlier: v0.3.2 (tag `v0.3.2`, W1N-182/#34: wizard waits for inbound SAS
+emojis) deployed 2026-08-18 from `d35c484` (backup
+`matrix_e2ee.bak-20260818-v0.3.1`); v0.3.1 (GitHub #33: peer-initiated
+verification wizard fix) deployed 2026-08-18 from `d22e935` (backup
+`matrix_e2ee.bak-20260818-v0.3.0`); v0.3.0 (W1N-180/#32: bot-initiated
+verification wizard; W1N-179/#31 `receive_mac_event` cancel-state fix)
+deployed 2026-08-18 from `216cc99` (backup
+`matrix_e2ee.bak-20260818-v0.2.10`).
+
 - Bot `@hass:chans.xyz` reused (E2EE device `rO1R915ncu`). Config Entry
   `01M04D7C1M4T2GX5VPG7NVQ7GV` (`source: import`, `state: loaded`). All
   settings via **Settings → Devices & Services → Matrix E2EE → Configure**.
 - Config Entry options: `allowed_rooms` `["!gidvAzpDzwtzfEDrqu:chans.xyz", "!boxfylDSzOvrWkcsyY:chans.xyz"]`,
   `allowed_users` `["@zhiqiang:chans.xyz"]`, `command_prefix` `"!"`.
+  **`verification_peer_users` not set** (v0.3.9+ SAS allowlist split from
+  `allowed_users`, W1N-156): defaults to empty → only the bot's own account
+  may drive SAS; `@zhiqiang` is denied until the option is added via
+  Settings → Devices & Services → Matrix E2EE → Configure.
 - Storage: `/config/.storage/matrix_e2ee_session.json` +
   `/config/.storage/matrix_e2ee_store/`. Backups:
-  `/homeassistant/.matrix-e2ee-backups/` (incl. `matrix_e2ee.bak-20260818-v0.2.10`,
+  `/homeassistant/.matrix-e2ee-backups/` (incl. `matrix_e2ee.bak-20260820-v0.3.2`,
+  `matrix_e2ee.bak-20260818-v0.3.1`,
+  `matrix_e2ee.bak-20260818-v0.3.0`,
+  `matrix_e2ee.bak-20260818-v0.2.10`,
   `matrix_e2ee.bak-20260816-v0.2.9`, `matrix_e2ee.bak-20260816-v0.2.8`);
   full HA backup slugs `3d9d36db` (pre-v0.1.4) + `9f223f35` (pre-v0.2.0).
-- v0.3.0: bot-initiated device verification wizard (W1N-180/#32).
+- v0.3.12: Matrix activity events + push diagnostics
+  (`matrix_e2ee_message_received` / `matrix_e2ee_verification_done`).
+  v0.3.9: Connection health binary sensor (W1N-185/#40), config-entry
+  diagnostics (W1N-184/#39), SAS/command allowlist split
+  `verification_peer_users` (W1N-156/#41), SAS/sync logs demoted
+  warning→info/debug (W1N-188/#38), URL normalization + single-entry
+  enforcement (W1N-190/#42).
+  v0.3.8: `m.key.verification.done` handshake for request-based SAS
+  (W1N-183/#35).
+  v0.3.2: wizard waits for inbound SAS emojis before the compare step
+  (W1N-182/#34).
+  v0.3.1: verification wizard waits for a peer-initiated inbound SAS instead
+  of the bot starting SAS (GitHub #33).
+  v0.3.0: bot-initiated device verification wizard (W1N-180/#32).
   v0.2.11: `receive_mac_event` no longer overrides canceled state (W1N-179/#31).
 - v0.2.9: restore SAS emoji rendering after vodozemac migration (W1N-175/#29).
   v0.2.8: SAS commitment unpadded base64 for Element interop (W1N-174/#28).
@@ -281,8 +312,12 @@ Custom **`matrix_e2ee`** integration — **Config Flow** (UI). See
   `matrix_e2ee.send_message` (room `!gidvAzpDzwtzfEDrqu`).
 - **SAS not yet completed:** every device requires explicit `confirm_verification`.
   Encrypted-room commands stay fail-closed until `@zhiqiang`'s device is verified.
-  Three paths available: SAS manual confirm, fingerprint, or the v0.3.0
-  bot-initiated device verification wizard (W1N-180), see
+  Since v0.3.9 the SAS driver gate uses `verification_peer_users` (empty on
+  this host) instead of `allowed_users` — add `@zhiqiang:chans.xyz` there
+  before retrying the wizard. Three paths available: SAS manual confirm,
+  fingerprint, or the device verification wizard (v0.3.0 bot-initiated,
+  reworked in v0.3.1/v0.3.2 to wait for a peer-initiated inbound SAS from
+  Element with emoji comparison), see
   [docs/home-assistant-matrix.md § Device verification](../docs/home-assistant-matrix.md).
 ## Known issues
 
@@ -315,6 +350,26 @@ backup `pre-maintenance-20260813` (slug `411a4ba5`, 144.26 MB) taken
 snapshot and plan a disk replacement / data-disk migration before the eMMC
 fails.
 
+## Matter Server (verified 2026-08-21)
+
+- Add-on `core_matter_server` (`homeassistant/aarch64-addon-matter-server`) runs the Matter
+  commissioner on this host (host networking; add-on container `app_core_matter_server`).
+- **After the ISP PD prefix rotates (PPPoE redial), the add-on can cache a stale IPv6 GUA
+  in its mDNS advertisement** — clients trying that dead address make Matter
+  commissioning/connection fail. Fix: restart the add-on so it re-enumerates addresses:
+  `ssh hassio@hass.windy.lan 'sudo -n -i ha apps restart core_matter_server'`
+  (`ha addons restart ...` also works; "addons" is deprecated in favor of "apps").
+- Verified 2026-08-21 (W1N-207): stale `240e:3bd:234:2f22:*` AAAA in mDNS removed by
+  restart; advertisement now carries only current GUA `240e:3bd:235:1fb2:*` + link-local;
+  CASE sessions with Aqara M3 / SmartThings hubs resumed over IPv6 link-local.
+
+> **Open items (2026-08-21, W1N-207):** a phone on LAN55 was querying five known
+> `_matter._tcp` instances of which only HA answered — the other Matter nodes are
+> offline / not announcing (device-side; user to confirm power/Wi-Fi). HA's IPv6
+> default route via NetworkManager was observed missing once (curl -6 intermittent,
+> while ping6 and `curl -6 --noproxy` work) — not the Matter root cause; re-check
+> on the next health snapshot.
+
 ## Related docs
 
 - [runbooks/home-assistant-maintenance.md](../runbooks/home-assistant-maintenance.md) — `ha` CLI maintenance runbook + [script](../runbooks/scripts/ha-maintenance.sh); custom-component zip install is §7