docs: record Matter/IPv6 findings — stale matter-server mDNS address, SSID cleanup, ER-X ULA infeasibility (W1N-207)

docs/lan-overview.md

@@ -13,6 +13,11 @@ from each section below.
 > **Verified live on 2026-08-06** by read-only SSH from the WSL client. No
 > changes were made. `gfw.windy.lan` root SSH was re-verified the same day after
 > the key was installed; its facts below are from the fresh probe.
+>
+> **IPv6 re-verified 2026-08-20** (read-only): UniFi controller `Default`
+> network IPv6 enabled (SLAAC/RA), both APs hold global SLAAC addresses, and
+> `zhiqiangf` key-only AP SSH re-confirmed. See
+> [unifi-network.md](unifi-network.md).
 
 ---
 
@@ -76,7 +81,10 @@ from each section below.
 | Port-forwards | `hass`→192.168.55.11:8123 · `transmission`→192.168.66.51:51413 · `ssh`→192.168.66.36:22 (orig 5822) · `openvpn`→192.168.66.32:1194 · WAN iface pppoe0 |
 | Management | SSH TCP 22 · EdgeOS GUI HTTP 80 / HTTPS 443 |
 
-**Static DHCP mappings (LAN66):** `OnePlus-12`=.37, `gfw`=.1, `hp-nas`=.32, `pihole`=.36, `pve`=.26, `transmission`=.51, `ubnt-6`=.6, `ubnt-app`=.46, `windy-pc`=.99. LAN55: `Aqara-Hub-M3-10CB`=.248.
+**Static DHCP mappings (LAN66):** `OnePlus-12`=.37, `gfw`=.1, `hp-nas`=.32, `pihole`=.36, `pve`=.26, `transmission`=.51, `ubnt-6`=.6, `ubnt-app`=.46, `windy-pc`=.99. LAN55: `Aqara-Hub-M3-10CB`=.248, `SmartThings-Station`=.48, `espressif`=.47,
+`hass`=.11, `hass-wifi`=.250, `ihost`=.12, `midea_ac_0418`=.10,
+`midea_e3_0198`=.42, `roborock-wm-a141`=.43, `samsung-hub`=.251,
+`matter`=.41 (added 2026-08-20).
 
 > **Note:** `LAN_IN`/`LAN_OUT` are defined but not applied to an interface, so LAN55
 > and LAN66 are bidirectionally reachable by default. Do not rely on those rules as
@@ -168,6 +176,35 @@ See [docs/unifi-openclash-localhost.md](../docs/unifi-openclash-localhost.md).
 Both reported **Connected** to `http://192.168.66.46:9080/inform` on 2026-08-06.
 AP SSH account is `zhiqiangf` (key-only, verified). See [docs/unifi-network.md](../docs/unifi-network.md).
 
+**IPv6 (verified 2026-08-20):** both APs hold global SLAAC IPv6 addresses on
+`br0` — U6 Lite `240e:3bd:235:1fb1::/64` (LAN66), UAP-AC-Lite
+`240e:3bd:235:1fb2::/64` (LAN55) — with RA default routes via `gw`; the
+controller's `Default` network has IPv6 enabled (SLAAC). Prefixes are dynamic
+(PPPoE PD), so they rotate on redial. Details:
+[docs/unifi-network.md](../docs/unifi-network.md).
+
+**SSID cleanup (2026-08-21, W1N-207):** the SmartThings Element/vWire provisioning
+SSIDs (`element-8a0d5133c9438f12`, `vwire-8b2d67469e455785`, `vport-F09FC22004E9`)
+were removed/disabled in the controller (`element_adopt` setting off, element wlanconf
+deleted, connectivity `x_mesh_essid`/`x_mesh_psk` cleared, device `x_vwirekey` removed,
+`vwire_enabled`/`mesh_sta_vap_enabled=false`) and cleared from both APs; all
+vwire/vport/element flags on the remaining SSIDs are now `disabled`.
+
+**Stable ULA on gw: not feasible (2026-08-21, W1N-207):** EdgeOS v3.0.1
+`interfaces switch switch0` rejects a static `ipv6 address`, and an explicit
+`router-advert` node *replaces* the DHCPv6-PD-slaac RA (drops the delegated GUA
+prefix from radvd → LAN55 loses IPv6 egress after RA expiry). Attempted and rolled
+back cleanly (no `save`; gw config unchanged). Consequence: after a PD rotation,
+restart HA's matter-server (see [hosts/hass.windy.lan.md](../hosts/hass.windy.lan.md))
+to clear stale IPv6 mDNS caches.
+
+**LAN55 RA environment (observed 2026-08-21):** besides `gw`, the SmartThings
+Station (.48) and Aqara M3 (.248) act as Thread border routers and advertise ULA
+prefixes (`fd00:5a7:6415:1::/64`, `fd97:d580:16fe:1::/64`); several LAN55 hosts
+(HA, PVE, UAP-AC-Lite) have IPv6 forwarding enabled and mark themselves as
+routers in NDP. This is normal Thread-BDR behaviour and was not the Matter
+failure cause.
+
 ---
 
 ## Quick orientation (who runs what)

docs/unifi-network.md

@@ -68,6 +68,66 @@ db.device.find(
 ).pretty()
 ```
 
+## IPv6 status (verified 2026-08-20)
+
+IPv6 is **enabled and live** on the main Wi-Fi networks. Read-only
+verification, no changes made.
+
+**Controller (`networkconf` in the `ace` DB):** the `Default` LAN network has
+`ipv6_enabled: true`, `ipv6_client_address_assignment: slaac`,
+`ipv6_ra_enabled: true`, `ipv6_ra_priority: high`, and
+`dhcpdv6_allow_slaac: true`. `ipv6_interface_type: "none"` is expected: the
+network's gateway is the third-party EdgeRouter (`gw`), so the controller does
+not manage WAN-side IPv6 — RA/SLAAC is served by the router.
+
+All active SSIDs map to the `Default` network: `ubnt-windy` (5G),
+`ubnt-windy-2` (2.4G), `ubnt-haas` (2.4G) — clients on them receive SLAAC IPv6.
+
+Exception: the dormant `ubnt-upg` VLAN 10 network (and its `ubnt-upg` SSID) has
+no IPv6 configuration (default off). See
+[Dedicated Wi-Fi through a third-party gateway](#dedicated-wi-fi-through-a-third-party-gateway).
+
+**APs (live):** both managed APs hold global SLAAC addresses on `br0` with a
+default route learned via RA from `gw`:
+
+| AP | Global IPv6 on `br0` (at check time) | Default route |
+|---|---|---|
+| U6 Lite (`192.168.66.6`) | `240e:3bd:235:1fb1:...`/64 | `default via fe80::... dev br0 proto ra` |
+| UAP-AC-Lite (`192.168.55.5`) | `240e:3bd:235:1fb2:...`/64 | `default via fe80::... dev br0 proto ra` |
+
+The delegated prefixes are dynamic ISP allocations (PPPoE PD `/60`) and rotate
+on redial; only the structure is stable.
+
+**Gateway (`gw`):** the IPv6 routing table shows connected `/64`s on `eth0`
+(LAN66) and `switch0` (LAN55) plus `::/0` via `pppoe0`.
+
+Re-verify:
+
+```bash
+ssh -4 -o BatchMode=yes zhiqiangf@192.168.66.6 'ip -6 addr show br0; ip -6 route show'
+ssh -4 -o BatchMode=yes zhiqiangf@192.168.55.5 'ip -6 addr show br0; ip -6 route show'
+```
+
+> **2026-08-21 (W1N-207):** SmartThings Element/vWire provisioning SSIDs
+> (`element-8a0d5133c9438f12`, `vwire-8b2d67469e455785`, `vport-F09FC22004E9`) were
+> removed (element_adopt setting disabled + element wlanconf deleted + device vwire
+> fields cleared) and confirmed off on both APs (normal SSIDs unchanged: `ubnt-windy`,
+> `ubnt-windy-2`, `ubnt-haas`, `ubnt-upg`). Root cause of Matter onboarding failure that
+> day: HA's matter-server advertised a stale IPv6 GUA (two prefix generations old) in
+> mDNS; fixed by restarting the add-on — see [hosts/hass.windy.lan.md](../hosts/hass.windy.lan.md).
+>
+> **SSID ↔ subnet split (Matter-relevant):** `ubnt-windy` (5G) is served only by the
+> U6 Lite on LAN66; `ubnt-haas` / `ubnt-windy-2` (2.4G) only by the UAP-AC-Lite on
+> LAN55. mDNS is link-local multicast and does **not** cross the routed 55/66
+> boundary (no mDNS reflector). Matter commissioning therefore requires phone and
+> device on the **same subnet (LAN55)**; a phone on 5G (LAN66) cannot discover a
+> LAN55 Matter device.
+>
+> **Cleanup side-effects (left as-is, harmless):** after the direct-DB cleanup,
+> `db.device.cfgversion` holds placeholder values (`0000000000000000` /
+> `1111111111111111`) and UAP-AC-Lite has `mesh_sta_vap_enabled=false`; the
+> controller has not reverted them and no functional impact was observed.
+
 ## Dedicated Wi-Fi through a third-party gateway
 
 ### Architecture boundary discovered on 2026-08-08
@@ -151,9 +211,10 @@ Use `ssh zhiqiangf@AP_IP` for the adopted-device account. Do not query or copy
 the controller's `mgmt` database setting into logs or documentation: it can
 contain the managed SSH password.
 
-On 2026-08-06, key-only IPv4 SSH was verified for both managed APs using the
+Key-only IPv4 SSH was verified for both managed APs using the `zhiqiangf`
-`zhiqiangf` account. Verify future access without permitting password or
+account on 2026-08-06 and re-verified 2026-08-20 (BatchMode with password and
-keyboard-interactive fallback:
+keyboard-interactive disabled; both APs still log in key-only). Verify future
+access without permitting password or keyboard-interactive fallback:
 
 ```bash
 ssh -4 -o BatchMode=yes -o PasswordAuthentication=no \

hosts/hass.windy.lan.md

@@ -248,28 +248,59 @@ The `_unrecorded_attributes` mechanism exists in Core 2026.8.1
 by recorder `shared_attrs_bytes_from_event`).
 
 
-### `matrix_e2ee` live tree (E2E Matrix bot, verified 2026-08-18, W1N-180)
+### `matrix_e2ee` live tree (E2E Matrix bot, verified 2026-08-20)
 
-**v0.3.0** (W1N-180/#32: bot-initiated device verification wizard; also
+**v0.3.12** (tag `v0.3.12`; feat — Matrix activity events
-includes W1N-179/#31 fix `receive_mac_event` cancel-state override):
+`matrix_e2ee_message_received` / `matrix_e2ee_verification_done` + push
-source copy from `/home/windy/project/ha-matrix-e2ee` main `216cc99`
+diagnostics; v0.3.9 added Connection health binary sensor, SAS/command
-deployed 2026-08-18 via SSH rsync from workstation (upgraded from v0.2.10,
+allowlist split, URL normalization, single-entry enforcement):
-backup `matrix_e2ee.bak-20260818-v0.2.10`).
+source copy from `/home/windy/project/ha-matrix-e2ee` `ea421ed` (tag
+`v0.3.12`) deployed 2026-08-20 via SSH rsync from workstation (upgraded
+from v0.3.2, backup `matrix_e2ee.bak-20260820-v0.3.2`).
 Custom **`matrix_e2ee`** integration — **Config Flow** (UI). See
 [docs/home-assistant-matrix.md](../docs/home-assistant-matrix.md).
 **Update runbook:** [runbooks/matrix-e2ee-update.md](../runbooks/matrix-e2ee-update.md).
 
+Earlier: v0.3.2 (tag `v0.3.2`, W1N-182/#34: wizard waits for inbound SAS
+emojis) deployed 2026-08-18 from `d35c484` (backup
+`matrix_e2ee.bak-20260818-v0.3.1`); v0.3.1 (GitHub #33: peer-initiated
+verification wizard fix) deployed 2026-08-18 from `d22e935` (backup
+`matrix_e2ee.bak-20260818-v0.3.0`); v0.3.0 (W1N-180/#32: bot-initiated
+verification wizard; W1N-179/#31 `receive_mac_event` cancel-state fix)
+deployed 2026-08-18 from `216cc99` (backup
+`matrix_e2ee.bak-20260818-v0.2.10`).
+
 - Bot `@hass:chans.xyz` reused (E2EE device `rO1R915ncu`). Config Entry
   `01M04D7C1M4T2GX5VPG7NVQ7GV` (`source: import`, `state: loaded`). All
   settings via **Settings → Devices & Services → Matrix E2EE → Configure**.
 - Config Entry options: `allowed_rooms` `["!gidvAzpDzwtzfEDrqu:chans.xyz", "!boxfylDSzOvrWkcsyY:chans.xyz"]`,
   `allowed_users` `["@zhiqiang:chans.xyz"]`, `command_prefix` `"!"`.
+  **`verification_peer_users` not set** (v0.3.9+ SAS allowlist split from
+  `allowed_users`, W1N-156): defaults to empty → only the bot's own account
+  may drive SAS; `@zhiqiang` is denied until the option is added via
+  Settings → Devices & Services → Matrix E2EE → Configure.
 - Storage: `/config/.storage/matrix_e2ee_session.json` +
   `/config/.storage/matrix_e2ee_store/`. Backups:
-  `/homeassistant/.matrix-e2ee-backups/` (incl. `matrix_e2ee.bak-20260818-v0.2.10`,
+  `/homeassistant/.matrix-e2ee-backups/` (incl. `matrix_e2ee.bak-20260820-v0.3.2`,
+  `matrix_e2ee.bak-20260818-v0.3.1`,
+  `matrix_e2ee.bak-20260818-v0.3.0`,
+  `matrix_e2ee.bak-20260818-v0.2.10`,
   `matrix_e2ee.bak-20260816-v0.2.9`, `matrix_e2ee.bak-20260816-v0.2.8`);
   full HA backup slugs `3d9d36db` (pre-v0.1.4) + `9f223f35` (pre-v0.2.0).
-- v0.3.0: bot-initiated device verification wizard (W1N-180/#32).
+- v0.3.12: Matrix activity events + push diagnostics
+  (`matrix_e2ee_message_received` / `matrix_e2ee_verification_done`).
+  v0.3.9: Connection health binary sensor (W1N-185/#40), config-entry
+  diagnostics (W1N-184/#39), SAS/command allowlist split
+  `verification_peer_users` (W1N-156/#41), SAS/sync logs demoted
+  warning→info/debug (W1N-188/#38), URL normalization + single-entry
+  enforcement (W1N-190/#42).
+  v0.3.8: `m.key.verification.done` handshake for request-based SAS
+  (W1N-183/#35).
+  v0.3.2: wizard waits for inbound SAS emojis before the compare step
+  (W1N-182/#34).
+  v0.3.1: verification wizard waits for a peer-initiated inbound SAS instead
+  of the bot starting SAS (GitHub #33).
+  v0.3.0: bot-initiated device verification wizard (W1N-180/#32).
   v0.2.11: `receive_mac_event` no longer overrides canceled state (W1N-179/#31).
 - v0.2.9: restore SAS emoji rendering after vodozemac migration (W1N-175/#29).
   v0.2.8: SAS commitment unpadded base64 for Element interop (W1N-174/#28).
@@ -281,8 +312,12 @@ Custom **`matrix_e2ee`** integration — **Config Flow** (UI). See
   `matrix_e2ee.send_message` (room `!gidvAzpDzwtzfEDrqu`).
 - **SAS not yet completed:** every device requires explicit `confirm_verification`.
   Encrypted-room commands stay fail-closed until `@zhiqiang`'s device is verified.
-  Three paths available: SAS manual confirm, fingerprint, or the v0.3.0
+  Since v0.3.9 the SAS driver gate uses `verification_peer_users` (empty on
-  bot-initiated device verification wizard (W1N-180), see
+  this host) instead of `allowed_users` — add `@zhiqiang:chans.xyz` there
+  before retrying the wizard. Three paths available: SAS manual confirm,
+  fingerprint, or the device verification wizard (v0.3.0 bot-initiated,
+  reworked in v0.3.1/v0.3.2 to wait for a peer-initiated inbound SAS from
+  Element with emoji comparison), see
   [docs/home-assistant-matrix.md § Device verification](../docs/home-assistant-matrix.md).
 ## Known issues
 
@@ -315,6 +350,26 @@ backup `pre-maintenance-20260813` (slug `411a4ba5`, 144.26 MB) taken
 snapshot and plan a disk replacement / data-disk migration before the eMMC
 fails.
 
+## Matter Server (verified 2026-08-21)
+
+- Add-on `core_matter_server` (`homeassistant/aarch64-addon-matter-server`) runs the Matter
+  commissioner on this host (host networking; add-on container `app_core_matter_server`).
+- **After the ISP PD prefix rotates (PPPoE redial), the add-on can cache a stale IPv6 GUA
+  in its mDNS advertisement** — clients trying that dead address make Matter
+  commissioning/connection fail. Fix: restart the add-on so it re-enumerates addresses:
+  `ssh hassio@hass.windy.lan 'sudo -n -i ha apps restart core_matter_server'`
+  (`ha addons restart ...` also works; "addons" is deprecated in favor of "apps").
+- Verified 2026-08-21 (W1N-207): stale `240e:3bd:234:2f22:*` AAAA in mDNS removed by
+  restart; advertisement now carries only current GUA `240e:3bd:235:1fb2:*` + link-local;
+  CASE sessions with Aqara M3 / SmartThings hubs resumed over IPv6 link-local.
+
+> **Open items (2026-08-21, W1N-207):** a phone on LAN55 was querying five known
+> `_matter._tcp` instances of which only HA answered — the other Matter nodes are
+> offline / not announcing (device-side; user to confirm power/Wi-Fi). HA's IPv6
+> default route via NetworkManager was observed missing once (curl -6 intermittent,
+> while ping6 and `curl -6 --noproxy` work) — not the Matter root cause; re-check
+> on the next health snapshot.
+
 ## Related docs
 
 - [runbooks/home-assistant-maintenance.md](../runbooks/home-assistant-maintenance.md) — `ha` CLI maintenance runbook + [script](../runbooks/scripts/ha-maintenance.sh); custom-component zip install is §7